drivers/staging/brcm80211/sys/wlc_mac80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16 #include <linux/kernel.h>
  17 #include <linux/ctype.h>
  18 #include <bcmdefs.h>
  19 #include <bcmdevs.h>
  20 #include <wlc_cfg.h>
  21 #include <osl.h>
  22 #include <bcmutils.h>
  23 #include <bcmwifi.h>
  24 #include <siutils.h>
  25 #include <bcmendian.h>
  26 #include <proto/wpa.h>
  27 #include <pcicfg.h>
  28 #include <bcmsrom.h>
  29 #include <wlioctl.h>
  30 #include <sbhndpio.h>
  31 #include <sbhnddma.h>
  32 #include <hnddma.h>
  33 #include <hndpmu.h>
  34 #include <d11.h>
  35 #include <wlc_rate.h>
  36 #include <wlc_pub.h>
  37 #include <wlc_key.h>
  38 #include <wlc_bsscfg.h>
  39 #include <wlc_channel.h>
  40 #include <wlc_event.h>
  41 #include <wlc_mac80211.h>
  42 #include <wlc_bmac.h>
  43 #include <wlc_scb.h>
  44 #include <wlc_phy_hal.h>
  45 #include <wlc_phy_shim.h>
  46 #include <wlc_antsel.h>
  47 #include <wlc_stf.h>
  48 #include <wlc_ampdu.h>
  49 #include <wlc_event.h>
  50 #include <wl_export.h>
  51 #include "d11ucode_ext.h"
  52 #include <wlc_alloc.h>
  53 #include <net/mac80211.h>
  54 #include <wl_dbg.h>
  55
  56
  57 /*
  58  * buffer length needed for wlc_format_ssid
  59  * 32 SSID chars, max of 4 chars for each SSID char "\xFF", plus NULL.
  60  */
  61 #define SSID_FMT_BUF_LEN        ((4 * DOT11_MAX_SSID_LEN) + 1)
  62
  63 #define TIMER_INTERVAL_WATCHDOG 1000    /* watchdog timer, in unit of ms */
  64 #define TIMER_INTERVAL_RADIOCHK 800     /* radio monitor timer, in unit of ms */
  65
  66 #ifndef WLC_MPC_MAX_DELAYCNT
  67 #define WLC_MPC_MAX_DELAYCNT    10      /* Max MPC timeout, in unit of watchdog */
  68 #endif
  69 #define WLC_MPC_MIN_DELAYCNT    1       /* Min MPC timeout, in unit of watchdog */
  70 #define WLC_MPC_THRESHOLD       3       /* MPC count threshold level */
  71
  72 #define BEACON_INTERVAL_DEFAULT 100     /* beacon interval, in unit of 1024TU */
  73 #define DTIM_INTERVAL_DEFAULT   3       /* DTIM interval, in unit of beacon interval */
  74
  75 /* Scale down delays to accommodate QT slow speed */
  76 #define BEACON_INTERVAL_DEF_QT  20      /* beacon interval, in unit of 1024TU */
  77 #define DTIM_INTERVAL_DEF_QT    1       /* DTIM interval, in unit of beacon interval */
  78
  79 #define TBTT_ALIGN_LEEWAY_US    100     /* min leeway before first TBTT in us */
  80
  81 /*
  82  * driver maintains internal 'tick'(wlc->pub->now) which increments in 1s OS timer(soft
  83  * watchdog) it is not a wall clock and won't increment when driver is in "down" state
  84  * this low resolution driver tick can be used for maintenance tasks such as phy
  85  * calibration and scb update
  86  */
  87
  88 /* watchdog trigger mode: OSL timer or TBTT */
  89 #define WLC_WATCHDOG_TBTT(wlc) \
  90         (wlc->stas_associated > 0 && wlc->PM != PM_OFF && wlc->pub->align_wd_tbtt)
  91
  92 /* To inform the ucode of the last mcast frame posted so that it can clear moredata bit */
  93 #define BCMCFID(wlc, fid) wlc_bmac_write_shm((wlc)->hw, M_BCMC_FID, (fid))
  94
  95 #define WLC_WAR16165(wlc) (BUSTYPE(wlc->pub->sih->bustype) == PCI_BUS && \
  96                                 (!AP_ENAB(wlc->pub)) && (wlc->war16165))
  97
  98 /* debug/trace */
  99 uint wl_msg_level =
 100 #if defined(BCMDBG)
 101     WL_ERROR_VAL;
 102 #else
 103     0;
 104 #endif                          /* BCMDBG */
 105
 106 /* Find basic rate for a given rate */
 107 #define WLC_BASIC_RATE(wlc, rspec)      (IS_MCS(rspec) ? \
 108                         (wlc)->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK].leg_ofdm] : \
 109                         (wlc)->band->basic_rate[rspec & RSPEC_RATE_MASK])
 110
 111 #define FRAMETYPE(r, mimoframe) (IS_MCS(r) ? mimoframe  : (IS_CCK(r) ? FT_CCK : FT_OFDM))
 112
 113 #define RFDISABLE_DEFAULT       10000000        /* rfdisable delay timer 500 ms, runs of ALP clock */
 114
 115 #define WLC_TEMPSENSE_PERIOD            10      /* 10 second timeout */
 116
 117 #define SCAN_IN_PROGRESS(x)     0
 118
 119 #define EPI_VERSION_NUM         0x054b0b00
 120
 121 #ifdef BCMDBG
 122 /* pointer to most recently allocated wl/wlc */
 123 static wlc_info_t *wlc_info_dbg = (wlc_info_t *) (NULL);
 124 #endif
 125
 126 /* IOVar table */
 127
 128 /* Parameter IDs, for use only internally to wlc -- in the wlc_iovars
 129  * table and by the wlc_doiovar() function.  No ordering is imposed:
 130  * the table is keyed by name, and the function uses a switch.
 131  */
 132 enum {
 133         IOV_MPC = 1,
 134         IOV_QTXPOWER,
 135         IOV_BCN_LI_BCN,         /* Beacon listen interval in # of beacons */
 136         IOV_LAST                /* In case of a need to check max ID number */
 137 };
 138
 139 const bcm_iovar_t wlc_iovars[] = {
 140         {"mpc", IOV_MPC, (IOVF_OPEN_ALLOW), IOVT_BOOL, 0},
 141         {"qtxpower", IOV_QTXPOWER, (IOVF_WHL | IOVF_OPEN_ALLOW), IOVT_UINT32,
 142          0},
 143         {"bcn_li_bcn", IOV_BCN_LI_BCN, 0, IOVT_UINT8, 0},
 144         {NULL, 0, 0, 0, 0}
 145 };
 146
 147 const u8 prio2fifo[NUMPRIO] = {
 148         TX_AC_BE_FIFO,          /* 0    BE      AC_BE   Best Effort */
 149         TX_AC_BK_FIFO,          /* 1    BK      AC_BK   Background */
 150         TX_AC_BK_FIFO,          /* 2    --      AC_BK   Background */
 151         TX_AC_BE_FIFO,          /* 3    EE      AC_BE   Best Effort */
 152         TX_AC_VI_FIFO,          /* 4    CL      AC_VI   Video */
 153         TX_AC_VI_FIFO,          /* 5    VI      AC_VI   Video */
 154         TX_AC_VO_FIFO,          /* 6    VO      AC_VO   Voice */
 155         TX_AC_VO_FIFO           /* 7    NC      AC_VO   Voice */
 156 };
 157
 158 /* precedences numbers for wlc queues. These are twice as may levels as
 159  * 802.1D priorities.
 160  * Odd numbers are used for HI priority traffic at same precedence levels
 161  * These constants are used ONLY by wlc_prio2prec_map.  Do not use them elsewhere.
 162  */
 163 #define _WLC_PREC_NONE          0       /* None = - */
 164 #define _WLC_PREC_BK            2       /* BK - Background */
 165 #define _WLC_PREC_BE            4       /* BE - Best-effort */
 166 #define _WLC_PREC_EE            6       /* EE - Excellent-effort */
 167 #define _WLC_PREC_CL            8       /* CL - Controlled Load */
 168 #define _WLC_PREC_VI            10      /* Vi - Video */
 169 #define _WLC_PREC_VO            12      /* Vo - Voice */
 170 #define _WLC_PREC_NC            14      /* NC - Network Control */
 171
 172 /* 802.1D Priority to precedence queue mapping */
 173 const u8 wlc_prio2prec_map[] = {
 174         _WLC_PREC_BE,           /* 0 BE - Best-effort */
 175         _WLC_PREC_BK,           /* 1 BK - Background */
 176         _WLC_PREC_NONE,         /* 2 None = - */
 177         _WLC_PREC_EE,           /* 3 EE - Excellent-effort */
 178         _WLC_PREC_CL,           /* 4 CL - Controlled Load */
 179         _WLC_PREC_VI,           /* 5 Vi - Video */
 180         _WLC_PREC_VO,           /* 6 Vo - Voice */
 181         _WLC_PREC_NC,           /* 7 NC - Network Control */
 182 };
 183
 184 /* Sanity check for tx_prec_map and fifo synchup
 185  * Either there are some packets pending for the fifo, else if fifo is empty then
 186  * all the corresponding precmap bits should be set
 187  */
 188 #define WLC_TX_FIFO_CHECK(wlc, fifo) (TXPKTPENDGET((wlc), (fifo)) ||    \
 189         (TXPKTPENDGET((wlc), (fifo)) == 0 && \
 190         ((wlc)->tx_prec_map & (wlc)->fifo2prec_map[(fifo)]) == \
 191         (wlc)->fifo2prec_map[(fifo)]))
 192
 193 /* TX FIFO number to WME/802.1E Access Category */
 194 const u8 wme_fifo2ac[] = { AC_BK, AC_BE, AC_VI, AC_VO, AC_BE, AC_BE };
 195
 196 /* WME/802.1E Access Category to TX FIFO number */
 197 static const u8 wme_ac2fifo[] = { 1, 0, 2, 3 };
 198
 199 static bool in_send_q = false;
 200
 201 /* Shared memory location index for various AC params */
 202 #define wme_shmemacindex(ac)    wme_ac2fifo[ac]
 203
 204 #ifdef BCMDBG
 205 static const char *fifo_names[] = {
 206         "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 207 const char *aci_names[] = { "AC_BE", "AC_BK", "AC_VI", "AC_VO" };
 208 #endif
 209
 210 static const u8 acbitmap2maxprio[] = {
 211         PRIO_8021D_BE, PRIO_8021D_BE, PRIO_8021D_BK, PRIO_8021D_BK,
 212         PRIO_8021D_VI, PRIO_8021D_VI, PRIO_8021D_VI, PRIO_8021D_VI,
 213         PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO,
 214         PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO
 215 };
 216
 217 /* currently the best mechanism for determining SIFS is the band in use */
 218 #define SIFS(band) ((band)->bandtype == WLC_BAND_5G ? APHY_SIFS_TIME : BPHY_SIFS_TIME);
 219
 220 /* value for # replay counters currently supported */
 221 #define WLC_REPLAY_CNTRS_VALUE  WPA_CAP_16_REPLAY_CNTRS
 222
 223 /* local prototypes */
 224 static u16 BCMFASTPATH wlc_d11hdrs_mac80211(wlc_info_t *wlc,
 225                                                struct ieee80211_hw *hw,
 226                                                struct sk_buff *p,
 227                                                struct scb *scb, uint frag,
 228                                                uint nfrags, uint queue,
 229                                                uint next_frag_len,
 230                                                wsec_key_t *key,
 231                                                ratespec_t rspec_override);
 232
 233 static void wlc_bss_default_init(wlc_info_t *wlc);
 234 static void wlc_ucode_mac_upd(wlc_info_t *wlc);
 235 static ratespec_t mac80211_wlc_set_nrate(wlc_info_t *wlc, wlcband_t *cur_band,
 236                                          u32 int_val);
 237 static void wlc_tx_prec_map_init(wlc_info_t *wlc);
 238 static void wlc_watchdog(void *arg);
 239 static void wlc_watchdog_by_timer(void *arg);
 240 static int wlc_set_rateset(wlc_info_t *wlc, wlc_rateset_t *rs_arg);
 241 static int wlc_iovar_rangecheck(wlc_info_t *wlc, u32 val,
 242                                 const bcm_iovar_t *vi);
 243 static u8 wlc_local_constraint_qdbm(wlc_info_t *wlc);
 244
 245 /* send and receive */
 246 static wlc_txq_info_t *wlc_txq_alloc(wlc_info_t *wlc, struct osl_info *osh);
 247 static void wlc_txq_free(wlc_info_t *wlc, struct osl_info *osh,
 248                          wlc_txq_info_t *qi);
 249 static void wlc_txflowcontrol_signal(wlc_info_t *wlc, wlc_txq_info_t *qi,
 250                                      bool on, int prio);
 251 static void wlc_txflowcontrol_reset(wlc_info_t *wlc);
 252 static u16 wlc_compute_airtime(wlc_info_t *wlc, ratespec_t rspec,
 253                                   uint length);
 254 static void wlc_compute_cck_plcp(ratespec_t rate, uint length, u8 *plcp);
 255 static void wlc_compute_ofdm_plcp(ratespec_t rate, uint length, u8 *plcp);
 256 static void wlc_compute_mimo_plcp(ratespec_t rate, uint length, u8 *plcp);
 257 static u16 wlc_compute_frame_dur(wlc_info_t *wlc, ratespec_t rate,
 258                                     u8 preamble_type, uint next_frag_len);
 259 static void wlc_recvctl(wlc_info_t *wlc, struct osl_info *osh, d11rxhdr_t *rxh,
 260                         struct sk_buff *p);
 261 static uint wlc_calc_frame_len(wlc_info_t *wlc, ratespec_t rate,
 262                                u8 preamble_type, uint dur);
 263 static uint wlc_calc_ack_time(wlc_info_t *wlc, ratespec_t rate,
 264                               u8 preamble_type);
 265 static uint wlc_calc_cts_time(wlc_info_t *wlc, ratespec_t rate,
 266                               u8 preamble_type);
 267 /* interrupt, up/down, band */
 268 static void wlc_setband(wlc_info_t *wlc, uint bandunit);
 269 static chanspec_t wlc_init_chanspec(wlc_info_t *wlc);
 270 static void wlc_bandinit_ordered(wlc_info_t *wlc, chanspec_t chanspec);
 271 static void wlc_bsinit(wlc_info_t *wlc);
 272 static int wlc_duty_cycle_set(wlc_info_t *wlc, int duty_cycle, bool isOFDM,
 273                               bool writeToShm);
 274 static void wlc_radio_hwdisable_upd(wlc_info_t *wlc);
 275 static bool wlc_radio_monitor_start(wlc_info_t *wlc);
 276 static void wlc_radio_timer(void *arg);
 277 static void wlc_radio_enable(wlc_info_t *wlc);
 278 static void wlc_radio_upd(wlc_info_t *wlc);
 279
 280 /* scan, association, BSS */
 281 static uint wlc_calc_ba_time(wlc_info_t *wlc, ratespec_t rate,
 282                              u8 preamble_type);
 283 static void wlc_update_mimo_band_bwcap(wlc_info_t *wlc, u8 bwcap);
 284 static void wlc_ht_update_sgi_rx(wlc_info_t *wlc, int val);
 285 void wlc_ht_mimops_cap_update(wlc_info_t *wlc, u8 mimops_mode);
 286 static void wlc_ht_update_ldpc(wlc_info_t *wlc, s8 val);
 287 static void wlc_war16165(wlc_info_t *wlc, bool tx);
 288
 289 static void wlc_process_eventq(void *arg);
 290 static void wlc_wme_retries_write(wlc_info_t *wlc);
 291 static bool wlc_attach_stf_ant_init(wlc_info_t *wlc);
 292 static uint wlc_attach_module(wlc_info_t *wlc);
 293 static void wlc_detach_module(wlc_info_t *wlc);
 294 static void wlc_timers_deinit(wlc_info_t *wlc);
 295 static void wlc_down_led_upd(wlc_info_t *wlc);
 296 static uint wlc_down_del_timer(wlc_info_t *wlc);
 297 static void wlc_ofdm_rateset_war(wlc_info_t *wlc);
 298 static int _wlc_ioctl(wlc_info_t *wlc, int cmd, void *arg, int len,
 299                       struct wlc_if *wlcif);
 300
 301 #if defined(BCMDBG)
 302 void wlc_get_rcmta(wlc_info_t *wlc, int idx, struct ether_addr *addr)
 303 {
 304         d11regs_t *regs = wlc->regs;
 305         u32 v32;
 306         struct osl_info *osh;
 307
 308         WL_TRACE(("wl%d: %s\n", WLCWLUNIT(wlc), __func__));
 309
 310         ASSERT(wlc->pub->corerev > 4);
 311
 312         osh = wlc->osh;
 313
 314         W_REG(osh, &regs->objaddr, (OBJADDR_RCMTA_SEL | (idx * 2)));
 315         (void)R_REG(osh, &regs->objaddr);
 316         v32 = R_REG(osh, &regs->objdata);
 317         addr->octet[0] = (u8) v32;
 318         addr->octet[1] = (u8) (v32 >> 8);
 319         addr->octet[2] = (u8) (v32 >> 16);
 320         addr->octet[3] = (u8) (v32 >> 24);
 321         W_REG(osh, &regs->objaddr, (OBJADDR_RCMTA_SEL | ((idx * 2) + 1)));
 322         (void)R_REG(osh, &regs->objaddr);
 323         v32 = R_REG(osh, (volatile u16 *)&regs->objdata);
 324         addr->octet[4] = (u8) v32;
 325         addr->octet[5] = (u8) (v32 >> 8);
 326 }
 327 #endif                          /* defined(BCMDBG) */
 328
 329 /* keep the chip awake if needed */
 330 bool wlc_stay_awake(wlc_info_t *wlc)
 331 {
 332         return true;
 333 }
 334
 335 /* conditions under which the PM bit should be set in outgoing frames and STAY_AWAKE is meaningful
 336  */
 337 bool wlc_ps_allowed(wlc_info_t *wlc)
 338 {
 339         int idx;
 340         wlc_bsscfg_t *cfg;
 341
 342         /* disallow PS when one of the following global conditions meets */
 343         if (!wlc->pub->associated || !wlc->PMenabled || wlc->PM_override)
 344                 return false;
 345
 346         /* disallow PS when one of these meets when not scanning */
 347         if (!wlc->PMblocked) {
 348                 if (AP_ACTIVE(wlc) || wlc->monitor)
 349                         return false;
 350         }
 351
 352         FOREACH_AS_STA(wlc, idx, cfg) {
 353                 /* disallow PS when one of the following bsscfg specific conditions meets */
 354                 if (!cfg->BSS || !WLC_PORTOPEN(cfg))
 355                         return false;
 356
 357                 if (!cfg->dtim_programmed)
 358                         return false;
 359         }
 360
 361         return true;
 362 }
 363
 364 void wlc_reset(wlc_info_t *wlc)
 365 {
 366         WL_TRACE(("wl%d: wlc_reset\n", wlc->pub->unit));
 367
 368         wlc->check_for_unaligned_tbtt = false;
 369
 370         /* slurp up hw mac counters before core reset */
 371         if (WLC_UPDATE_STATS(wlc)) {
 372                 wlc_statsupd(wlc);
 373
 374                 /* reset our snapshot of macstat counters */
 375                 bzero((char *)wlc->core->macstat_snapshot, sizeof(macstat_t));
 376         }
 377
 378         wlc_bmac_reset(wlc->hw);
 379         wlc_ampdu_reset(wlc->ampdu);
 380         wlc->txretried = 0;
 381
 382 }
 383
 384 void wlc_fatal_error(wlc_info_t *wlc)
 385 {
 386         WL_ERROR(("wl%d: fatal error, reinitializing\n", wlc->pub->unit));
 387         wl_init(wlc->wl);
 388 }
 389
 390 /* Return the channel the driver should initialize during wlc_init.
 391  * the channel may have to be changed from the currently configured channel
 392  * if other configurations are in conflict (bandlocked, 11n mode disabled,
 393  * invalid channel for current country, etc.)
 394  */
 395 static chanspec_t wlc_init_chanspec(wlc_info_t *wlc)
 396 {
 397         chanspec_t chanspec =
 398             1 | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE |
 399             WL_CHANSPEC_BAND_2G;
 400
 401         /* make sure the channel is on the supported band if we are band-restricted */
 402         if (wlc->bandlocked || NBANDS(wlc) == 1) {
 403                 ASSERT(CHSPEC_WLCBANDUNIT(chanspec) == wlc->band->bandunit);
 404         }
 405         ASSERT(wlc_valid_chanspec_db(wlc->cmi, chanspec));
 406         return chanspec;
 407 }
 408
 409 struct scb global_scb;
 410
 411 static void wlc_init_scb(wlc_info_t *wlc, struct scb *scb)
 412 {
 413         int i;
 414         scb->flags = SCB_WMECAP | SCB_HTCAP;
 415         for (i = 0; i < NUMPRIO; i++)
 416                 scb->seqnum[i] = 0;
 417 }
 418
 419 void wlc_init(wlc_info_t *wlc)
 420 {
 421         d11regs_t *regs;
 422         chanspec_t chanspec;
 423         int i;
 424         wlc_bsscfg_t *bsscfg;
 425         bool mute = false;
 426
 427         WL_TRACE(("wl%d: wlc_init\n", wlc->pub->unit));
 428
 429         regs = wlc->regs;
 430
 431         /* This will happen if a big-hammer was executed. In that case, we want to go back
 432          * to the channel that we were on and not new channel
 433          */
 434         if (wlc->pub->associated)
 435                 chanspec = wlc->home_chanspec;
 436         else
 437                 chanspec = wlc_init_chanspec(wlc);
 438
 439         wlc_bmac_init(wlc->hw, chanspec, mute);
 440
 441         wlc->seckeys = wlc_bmac_read_shm(wlc->hw, M_SECRXKEYS_PTR) * 2;
 442         if (D11REV_GE(wlc->pub->corerev, 15) && (wlc->machwcap & MCAP_TKIPMIC))
 443                 wlc->tkmickeys =
 444                     wlc_bmac_read_shm(wlc->hw, M_TKMICKEYS_PTR) * 2;
 445
 446         /* update beacon listen interval */
 447         wlc_bcn_li_upd(wlc);
 448         wlc->bcn_wait_prd =
 449             (u8) (wlc_bmac_read_shm(wlc->hw, M_NOSLPZNATDTIM) >> 10);
 450         ASSERT(wlc->bcn_wait_prd > 0);
 451
 452         /* the world is new again, so is our reported rate */
 453         wlc_reprate_init(wlc);
 454
 455         /* write ethernet address to core */
 456         FOREACH_BSS(wlc, i, bsscfg) {
 457                 wlc_set_mac(bsscfg);
 458                 wlc_set_bssid(bsscfg);
 459         }
 460
 461         /* Update tsf_cfprep if associated and up */
 462         if (wlc->pub->associated) {
 463                 FOREACH_BSS(wlc, i, bsscfg) {
 464                         if (bsscfg->up) {
 465                                 u32 bi;
 466
 467                                 /* get beacon period from bsscfg and convert to uS */
 468                                 bi = bsscfg->current_bss->beacon_period << 10;
 469                                 /* update the tsf_cfprep register */
 470                                 /* since init path would reset to default value */
 471                                 W_REG(wlc->osh, &regs->tsf_cfprep,
 472                                       (bi << CFPREP_CBI_SHIFT));
 473
 474                                 /* Update maccontrol PM related bits */
 475                                 wlc_set_ps_ctrl(wlc);
 476
 477                                 break;
 478                         }
 479                 }
 480         }
 481
 482         wlc_key_hw_init_all(wlc);
 483
 484         wlc_bandinit_ordered(wlc, chanspec);
 485
 486         wlc_init_scb(wlc, &global_scb);
 487
 488         /* init probe response timeout */
 489         wlc_write_shm(wlc, M_PRS_MAXTIME, wlc->prb_resp_timeout);
 490
 491         /* init max burst txop (framebursting) */
 492         wlc_write_shm(wlc, M_MBURST_TXOP,
 493                       (wlc->
 494                        _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
 495
 496         /* initialize maximum allowed duty cycle */
 497         wlc_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
 498         wlc_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
 499
 500         /* Update some shared memory locations related to max AMPDU size allowed to received */
 501         wlc_ampdu_shm_upd(wlc->ampdu);
 502
 503         /* band-specific inits */
 504         wlc_bsinit(wlc);
 505
 506         /* Enable EDCF mode (while the MAC is suspended) */
 507         if (EDCF_ENAB(wlc->pub)) {
 508                 OR_REG(wlc->osh, &regs->ifs_ctl, IFS_USEEDCF);
 509                 wlc_edcf_setparams(wlc->cfg, false);
 510         }
 511
 512         /* Init precedence maps for empty FIFOs */
 513         wlc_tx_prec_map_init(wlc);
 514
 515         /* read the ucode version if we have not yet done so */
 516         if (wlc->ucode_rev == 0) {
 517                 wlc->ucode_rev =
 518                     wlc_read_shm(wlc, M_BOM_REV_MAJOR) << NBITS(u16);
 519                 wlc->ucode_rev |= wlc_read_shm(wlc, M_BOM_REV_MINOR);
 520         }
 521
 522         /* ..now really unleash hell (allow the MAC out of suspend) */
 523         wlc_enable_mac(wlc);
 524
 525         /* clear tx flow control */
 526         wlc_txflowcontrol_reset(wlc);
 527
 528         /* clear tx data fifo suspends */
 529         wlc->tx_suspended = false;
 530
 531         /* enable the RF Disable Delay timer */
 532         if (D11REV_GE(wlc->pub->corerev, 10))
 533                 W_REG(wlc->osh, &wlc->regs->rfdisabledly, RFDISABLE_DEFAULT);
 534
 535         /* initialize mpc delay */
 536         wlc->mpc_delay_off = wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
 537
 538         /*
 539          * Initialize WME parameters; if they haven't been set by some other
 540          * mechanism (IOVar, etc) then read them from the hardware.
 541          */
 542         if (WLC_WME_RETRY_SHORT_GET(wlc, 0) == 0) {     /* Unintialized; read from HW */
 543                 int ac;
 544
 545                 ASSERT(wlc->clk);
 546                 for (ac = 0; ac < AC_COUNT; ac++) {
 547                         wlc->wme_retries[ac] =
 548                             wlc_read_shm(wlc, M_AC_TXLMT_ADDR(ac));
 549                 }
 550         }
 551 }
 552
 553 void wlc_mac_bcn_promisc_change(wlc_info_t *wlc, bool promisc)
 554 {
 555         wlc->bcnmisc_monitor = promisc;
 556         wlc_mac_bcn_promisc(wlc);
 557 }
 558
 559 void wlc_mac_bcn_promisc(wlc_info_t *wlc)
 560 {
 561         if ((AP_ENAB(wlc->pub) && (N_ENAB(wlc->pub) || wlc->band->gmode)) ||
 562             wlc->bcnmisc_ibss || wlc->bcnmisc_scan || wlc->bcnmisc_monitor)
 563                 wlc_mctrl(wlc, MCTL_BCNS_PROMISC, MCTL_BCNS_PROMISC);
 564         else
 565                 wlc_mctrl(wlc, MCTL_BCNS_PROMISC, 0);
 566 }
 567
 568 /* set or clear maccontrol bits MCTL_PROMISC and MCTL_KEEPCONTROL */
 569 void wlc_mac_promisc(wlc_info_t *wlc)
 570 {
 571         u32 promisc_bits = 0;
 572
 573         /* promiscuous mode just sets MCTL_PROMISC
 574          * Note: APs get all BSS traffic without the need to set the MCTL_PROMISC bit
 575          * since all BSS data traffic is directed at the AP
 576          */
 577         if (PROMISC_ENAB(wlc->pub) && !AP_ENAB(wlc->pub) && !wlc->wet)
 578                 promisc_bits |= MCTL_PROMISC;
 579
 580         /* monitor mode needs both MCTL_PROMISC and MCTL_KEEPCONTROL
 581          * Note: monitor mode also needs MCTL_BCNS_PROMISC, but that is
 582          * handled in wlc_mac_bcn_promisc()
 583          */
 584         if (MONITOR_ENAB(wlc))
 585                 promisc_bits |= MCTL_PROMISC | MCTL_KEEPCONTROL;
 586
 587         wlc_mctrl(wlc, MCTL_PROMISC | MCTL_KEEPCONTROL, promisc_bits);
 588 }
 589
 590 /* check if hps and wake states of sw and hw are in sync */
 591 bool wlc_ps_check(wlc_info_t *wlc)
 592 {
 593         bool res = true;
 594         bool hps, wake;
 595         bool wake_ok;
 596
 597         if (!AP_ACTIVE(wlc)) {
 598                 volatile u32 tmp;
 599                 tmp = R_REG(wlc->osh, &wlc->regs->maccontrol);
 600
 601                 /* If deviceremoved is detected, then don't take any action as this can be called
 602                  * in any context. Assume that caller will take care of the condition. This is just
 603                  * to avoid assert
 604                  */
 605                 if (tmp == 0xffffffff) {
 606                         WL_ERROR(("wl%d: %s: dead chip\n", wlc->pub->unit,
 607                                   __func__));
 608                         return DEVICEREMOVED(wlc);
 609                 }
 610
 611                 hps = PS_ALLOWED(wlc);
 612
 613                 if (hps != ((tmp & MCTL_HPS) != 0)) {
 614                         int idx;
 615                         wlc_bsscfg_t *cfg;
 616                         WL_ERROR(("wl%d: hps not sync, sw %d, maccontrol 0x%x\n", wlc->pub->unit, hps, tmp));
 617                         FOREACH_BSS(wlc, idx, cfg) {
 618                                 if (!BSSCFG_STA(cfg))
 619                                         continue;
 620                         }
 621
 622                         res = false;
 623                 }
 624                 /* For a monolithic build the wake check can be exact since it looks at wake
 625                  * override bits. The MCTL_WAKE bit should match the 'wake' value.
 626                  */
 627                 wake = STAY_AWAKE(wlc) || wlc->hw->wake_override;
 628                 wake_ok = (wake == ((tmp & MCTL_WAKE) != 0));
 629                 if (hps && !wake_ok) {
 630                         WL_ERROR(("wl%d: wake not sync, sw %d maccontrol 0x%x\n", wlc->pub->unit, wake, tmp));
 631                         res = false;
 632                 }
 633         }
 634         ASSERT(res);
 635         return res;
 636 }
 637
 638 /* push sw hps and wake state through hardware */
 639 void wlc_set_ps_ctrl(wlc_info_t *wlc)
 640 {
 641         u32 v1, v2;
 642         bool hps, wake;
 643         bool awake_before;
 644
 645         hps = PS_ALLOWED(wlc);
 646         wake = hps ? (STAY_AWAKE(wlc)) : true;
 647
 648         WL_TRACE(("wl%d: wlc_set_ps_ctrl: hps %d wake %d\n", wlc->pub->unit,
 649                   hps, wake));
 650
 651         v1 = R_REG(wlc->osh, &wlc->regs->maccontrol);
 652         v2 = 0;
 653         if (hps)
 654                 v2 |= MCTL_HPS;
 655         if (wake)
 656                 v2 |= MCTL_WAKE;
 657
 658         wlc_mctrl(wlc, MCTL_WAKE | MCTL_HPS, v2);
 659
 660         awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
 661
 662         if (wake && !awake_before)
 663                 wlc_bmac_wait_for_wake(wlc->hw);
 664
 665 }
 666
 667 /*
 668  * Write this BSS config's MAC address to core.
 669  * Updates RXE match engine.
 670  */
 671 int wlc_set_mac(wlc_bsscfg_t *cfg)
 672 {
 673         int err = 0;
 674         wlc_info_t *wlc = cfg->wlc;
 675
 676         if (cfg == wlc->cfg) {
 677                 /* enter the MAC addr into the RXE match registers */
 678                 wlc_set_addrmatch(wlc, RCM_MAC_OFFSET, &cfg->cur_etheraddr);
 679         }
 680
 681         wlc_ampdu_macaddr_upd(wlc);
 682
 683         return err;
 684 }
 685
 686 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
 687  * Updates RXE match engine.
 688  */
 689 void wlc_set_bssid(wlc_bsscfg_t *cfg)
 690 {
 691         wlc_info_t *wlc = cfg->wlc;
 692
 693         /* if primary config, we need to update BSSID in RXE match registers */
 694         if (cfg == wlc->cfg) {
 695                 wlc_set_addrmatch(wlc, RCM_BSSID_OFFSET, &cfg->BSSID);
 696         }
 697 #ifdef SUPPORT_HWKEYS
 698         else if (BSSCFG_STA(cfg) && cfg->BSS) {
 699                 wlc_rcmta_add_bssid(wlc, cfg);
 700         }
 701 #endif
 702 }
 703
 704 /*
 705  * Suspend the the MAC and update the slot timing
 706  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
 707  */
 708 void wlc_switch_shortslot(wlc_info_t *wlc, bool shortslot)
 709 {
 710         int idx;
 711         wlc_bsscfg_t *cfg;
 712
 713         ASSERT(wlc->band->gmode);
 714
 715         /* use the override if it is set */
 716         if (wlc->shortslot_override != WLC_SHORTSLOT_AUTO)
 717                 shortslot = (wlc->shortslot_override == WLC_SHORTSLOT_ON);
 718
 719         if (wlc->shortslot == shortslot)
 720                 return;
 721
 722         wlc->shortslot = shortslot;
 723
 724         /* update the capability based on current shortslot mode */
 725         FOREACH_BSS(wlc, idx, cfg) {
 726                 if (!cfg->associated)
 727                         continue;
 728                 cfg->current_bss->capability &= ~DOT11_CAP_SHORTSLOT;
 729                 if (wlc->shortslot)
 730                         cfg->current_bss->capability |= DOT11_CAP_SHORTSLOT;
 731         }
 732
 733         wlc_bmac_set_shortslot(wlc->hw, shortslot);
 734 }
 735
 736 static u8 wlc_local_constraint_qdbm(wlc_info_t *wlc)
 737 {
 738         u8 local;
 739         s16 local_max;
 740
 741         local = WLC_TXPWR_MAX;
 742         if (wlc->pub->associated &&
 743             (wf_chspec_ctlchan(wlc->chanspec) ==
 744              wf_chspec_ctlchan(wlc->home_chanspec))) {
 745
 746                 /* get the local power constraint if we are on the AP's
 747                  * channel [802.11h, 7.3.2.13]
 748                  */
 749                 /* Clamp the value between 0 and WLC_TXPWR_MAX w/o overflowing the target */
 750                 local_max =
 751                     (wlc->txpwr_local_max -
 752                      wlc->txpwr_local_constraint) * WLC_TXPWR_DB_FACTOR;
 753                 if (local_max > 0 && local_max < WLC_TXPWR_MAX)
 754                         return (u8) local_max;
 755                 if (local_max < 0)
 756                         return 0;
 757         }
 758
 759         return local;
 760 }
 761
 762 /* propagate home chanspec to all bsscfgs in case bsscfg->current_bss->chanspec is referenced */
 763 void wlc_set_home_chanspec(wlc_info_t *wlc, chanspec_t chanspec)
 764 {
 765         if (wlc->home_chanspec != chanspec) {
 766                 int idx;
 767                 wlc_bsscfg_t *cfg;
 768
 769                 wlc->home_chanspec = chanspec;
 770
 771                 FOREACH_BSS(wlc, idx, cfg) {
 772                         if (!cfg->associated)
 773                                 continue;
 774                         cfg->target_bss->chanspec = chanspec;
 775                         cfg->current_bss->chanspec = chanspec;
 776                 }
 777
 778         }
 779 }
 780
 781 static void wlc_set_phy_chanspec(wlc_info_t *wlc, chanspec_t chanspec)
 782 {
 783         /* Save our copy of the chanspec */
 784         wlc->chanspec = chanspec;
 785
 786         /* Set the chanspec and power limits for this locale after computing
 787          * any 11h local tx power constraints.
 788          */
 789         wlc_channel_set_chanspec(wlc->cmi, chanspec,
 790                                  wlc_local_constraint_qdbm(wlc));
 791
 792         if (wlc->stf->ss_algosel_auto)
 793                 wlc_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
 794                                             chanspec);
 795
 796         wlc_stf_ss_update(wlc, wlc->band);
 797
 798 }
 799
 800 void wlc_set_chanspec(wlc_info_t *wlc, chanspec_t chanspec)
 801 {
 802         uint bandunit;
 803         bool switchband = false;
 804         chanspec_t old_chanspec = wlc->chanspec;
 805
 806         if (!wlc_valid_chanspec_db(wlc->cmi, chanspec)) {
 807                 WL_ERROR(("wl%d: %s: Bad channel %d\n",
 808                           wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec)));
 809                 ASSERT(wlc_valid_chanspec_db(wlc->cmi, chanspec));
 810                 return;
 811         }
 812
 813         /* Switch bands if necessary */
 814         if (NBANDS(wlc) > 1) {
 815                 bandunit = CHSPEC_WLCBANDUNIT(chanspec);
 816                 if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
 817                         switchband = true;
 818                         if (wlc->bandlocked) {
 819                                 WL_ERROR(("wl%d: %s: chspec %d band is locked!\n", wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec)));
 820                                 return;
 821                         }
 822                         /* BMAC_NOTE: should the setband call come after the wlc_bmac_chanspec() ?
 823                          * if the setband updates (wlc_bsinit) use low level calls to inspect and
 824                          * set state, the state inspected may be from the wrong band, or the
 825                          * following wlc_bmac_set_chanspec() may undo the work.
 826                          */
 827                         wlc_setband(wlc, bandunit);
 828                 }
 829         }
 830
 831         ASSERT(N_ENAB(wlc->pub) || !CHSPEC_IS40(chanspec));
 832
 833         /* sync up phy/radio chanspec */
 834         wlc_set_phy_chanspec(wlc, chanspec);
 835
 836         /* init antenna selection */
 837         if (CHSPEC_WLC_BW(old_chanspec) != CHSPEC_WLC_BW(chanspec)) {
 838                 if (WLANTSEL_ENAB(wlc))
 839                         wlc_antsel_init(wlc->asi);
 840
 841                 /* Fix the hardware rateset based on bw.
 842                  * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
 843                  */
 844                 wlc_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
 845                                           wlc->band->
 846                                           mimo_cap_40 ? CHSPEC_WLC_BW(chanspec)
 847                                           : 0);
 848         }
 849
 850         /* update some mac configuration since chanspec changed */
 851         wlc_ucode_mac_upd(wlc);
 852 }
 853
 854 #if defined(BCMDBG)
 855 static int wlc_get_current_txpwr(wlc_info_t *wlc, void *pwr, uint len)
 856 {
 857         txpwr_limits_t txpwr;
 858         tx_power_t power;
 859         tx_power_legacy_t *old_power = NULL;
 860         int r, c;
 861         uint qdbm;
 862         bool override;
 863
 864         if (len == sizeof(tx_power_legacy_t))
 865                 old_power = (tx_power_legacy_t *) pwr;
 866         else if (len < sizeof(tx_power_t))
 867                 return BCME_BUFTOOSHORT;
 868
 869         bzero(&power, sizeof(tx_power_t));
 870
 871         power.chanspec = WLC_BAND_PI_RADIO_CHANSPEC;
 872         if (wlc->pub->associated)
 873                 power.local_chanspec = wlc->home_chanspec;
 874
 875         /* Return the user target tx power limits for the various rates.  Note  wlc_phy.c's
 876          * public interface only implements getting and setting a single value for all of
 877          * rates, so we need to fill the array ourselves.
 878          */
 879         wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
 880         for (r = 0; r < WL_TX_POWER_RATES; r++) {
 881                 power.user_limit[r] = (u8) qdbm;
 882         }
 883
 884         power.local_max = wlc->txpwr_local_max * WLC_TXPWR_DB_FACTOR;
 885         power.local_constraint =
 886             wlc->txpwr_local_constraint * WLC_TXPWR_DB_FACTOR;
 887
 888         power.antgain[0] = wlc->bandstate[BAND_2G_INDEX]->antgain;
 889         power.antgain[1] = wlc->bandstate[BAND_5G_INDEX]->antgain;
 890
 891         wlc_channel_reg_limits(wlc->cmi, power.chanspec, &txpwr);
 892
 893 #if WL_TX_POWER_CCK_NUM != WLC_NUM_RATES_CCK
 894 #error "WL_TX_POWER_CCK_NUM != WLC_NUM_RATES_CCK"
 895 #endif
 896
 897         /* CCK tx power limits */
 898         for (c = 0, r = WL_TX_POWER_CCK_FIRST; c < WL_TX_POWER_CCK_NUM;
 899              c++, r++)
 900                 power.reg_limit[r] = txpwr.cck[c];
 901
 902 #if WL_TX_POWER_OFDM_NUM != WLC_NUM_RATES_OFDM
 903 #error "WL_TX_POWER_OFDM_NUM != WLC_NUM_RATES_OFDM"
 904 #endif
 905
 906         /* 20 MHz OFDM SISO tx power limits */
 907         for (c = 0, r = WL_TX_POWER_OFDM_FIRST; c < WL_TX_POWER_OFDM_NUM;
 908              c++, r++)
 909                 power.reg_limit[r] = txpwr.ofdm[c];
 910
 911         if (WLC_PHY_11N_CAP(wlc->band)) {
 912
 913                 /* 20 MHz OFDM CDD tx power limits */
 914                 for (c = 0, r = WL_TX_POWER_OFDM20_CDD_FIRST;
 915                      c < WL_TX_POWER_OFDM_NUM; c++, r++)
 916                         power.reg_limit[r] = txpwr.ofdm_cdd[c];
 917
 918                 /* 40 MHz OFDM SISO tx power limits */
 919                 for (c = 0, r = WL_TX_POWER_OFDM40_SISO_FIRST;
 920                      c < WL_TX_POWER_OFDM_NUM; c++, r++)
 921                         power.reg_limit[r] = txpwr.ofdm_40_siso[c];
 922
 923                 /* 40 MHz OFDM CDD tx power limits */
 924                 for (c = 0, r = WL_TX_POWER_OFDM40_CDD_FIRST;
 925                      c < WL_TX_POWER_OFDM_NUM; c++, r++)
 926                         power.reg_limit[r] = txpwr.ofdm_40_cdd[c];
 927
 928 #if WL_TX_POWER_MCS_1_STREAM_NUM != WLC_NUM_RATES_MCS_1_STREAM
 929 #error "WL_TX_POWER_MCS_1_STREAM_NUM != WLC_NUM_RATES_MCS_1_STREAM"
 930 #endif
 931
 932                 /* 20MHz MCS0-7 SISO tx power limits */
 933                 for (c = 0, r = WL_TX_POWER_MCS20_SISO_FIRST;
 934                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 935                         power.reg_limit[r] = txpwr.mcs_20_siso[c];
 936
 937                 /* 20MHz MCS0-7 CDD tx power limits */
 938                 for (c = 0, r = WL_TX_POWER_MCS20_CDD_FIRST;
 939                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 940                         power.reg_limit[r] = txpwr.mcs_20_cdd[c];
 941
 942                 /* 20MHz MCS0-7 STBC tx power limits */
 943                 for (c = 0, r = WL_TX_POWER_MCS20_STBC_FIRST;
 944                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 945                         power.reg_limit[r] = txpwr.mcs_20_stbc[c];
 946
 947                 /* 40MHz MCS0-7 SISO tx power limits */
 948                 for (c = 0, r = WL_TX_POWER_MCS40_SISO_FIRST;
 949                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 950                         power.reg_limit[r] = txpwr.mcs_40_siso[c];
 951
 952                 /* 40MHz MCS0-7 CDD tx power limits */
 953                 for (c = 0, r = WL_TX_POWER_MCS40_CDD_FIRST;
 954                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 955                         power.reg_limit[r] = txpwr.mcs_40_cdd[c];
 956
 957                 /* 40MHz MCS0-7 STBC tx power limits */
 958                 for (c = 0, r = WL_TX_POWER_MCS40_STBC_FIRST;
 959                      c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 960                         power.reg_limit[r] = txpwr.mcs_40_stbc[c];
 961
 962 #if WL_TX_POWER_MCS_2_STREAM_NUM != WLC_NUM_RATES_MCS_2_STREAM
 963 #error "WL_TX_POWER_MCS_2_STREAM_NUM != WLC_NUM_RATES_MCS_2_STREAM"
 964 #endif
 965
 966                 /* 20MHz MCS8-15 SDM tx power limits */
 967                 for (c = 0, r = WL_TX_POWER_MCS20_SDM_FIRST;
 968                      c < WLC_NUM_RATES_MCS_2_STREAM; c++, r++)
 969                         power.reg_limit[r] = txpwr.mcs_20_mimo[c];
 970
 971                 /* 40MHz MCS8-15 SDM tx power limits */
 972                 for (c = 0, r = WL_TX_POWER_MCS40_SDM_FIRST;
 973                      c < WLC_NUM_RATES_MCS_2_STREAM; c++, r++)
 974                         power.reg_limit[r] = txpwr.mcs_40_mimo[c];
 975
 976                 /* MCS 32 */
 977                 power.reg_limit[WL_TX_POWER_MCS_32] = txpwr.mcs32;
 978         }
 979
 980         wlc_phy_txpower_get_current(wlc->band->pi, &power,
 981                                     CHSPEC_CHANNEL(power.chanspec));
 982
 983         /* copy the tx_power_t struct to the return buffer,
 984          * or convert to a tx_power_legacy_t struct
 985          */
 986         if (!old_power) {
 987                 bcopy(&power, pwr, sizeof(tx_power_t));
 988         } else {
 989                 int band_idx = CHSPEC_IS2G(power.chanspec) ? 0 : 1;
 990
 991                 bzero(old_power, sizeof(tx_power_legacy_t));
 992
 993                 old_power->txpwr_local_max = power.local_max;
 994                 old_power->txpwr_local_constraint = power.local_constraint;
 995                 if (CHSPEC_IS2G(power.chanspec)) {
 996                         old_power->txpwr_chan_reg_max = txpwr.cck[0];
 997                         old_power->txpwr_est_Pout[band_idx] =
 998                             power.est_Pout_cck;
 999                         old_power->txpwr_est_Pout_gofdm = power.est_Pout[0];
1000                 } else {
1001                         old_power->txpwr_chan_reg_max = txpwr.ofdm[0];
1002                         old_power->txpwr_est_Pout[band_idx] = power.est_Pout[0];
1003                 }
1004                 old_power->txpwr_antgain[0] = power.antgain[0];
1005                 old_power->txpwr_antgain[1] = power.antgain[1];
1006
1007                 for (r = 0; r < NUM_PWRCTRL_RATES; r++) {
1008                         old_power->txpwr_band_max[r] = power.user_limit[r];
1009                         old_power->txpwr_limit[r] = power.reg_limit[r];
1010                         old_power->txpwr_target[band_idx][r] = power.target[r];
1011                         if (CHSPEC_IS2G(power.chanspec))
1012                                 old_power->txpwr_bphy_cck_max[r] =
1013                                     power.board_limit[r];
1014                         else
1015                                 old_power->txpwr_aphy_max[r] =
1016                                     power.board_limit[r];
1017                 }
1018         }
1019
1020         return 0;
1021 }
1022 #endif                          /* defined(BCMDBG) */
1023
1024 static u32 wlc_watchdog_backup_bi(wlc_info_t *wlc)
1025 {
1026         u32 bi;
1027         bi = 2 * wlc->cfg->current_bss->dtim_period *
1028             wlc->cfg->current_bss->beacon_period;
1029         if (wlc->bcn_li_dtim)
1030                 bi *= wlc->bcn_li_dtim;
1031         else if (wlc->bcn_li_bcn)
1032                 /* recalculate bi based on bcn_li_bcn */
1033                 bi = 2 * wlc->bcn_li_bcn * wlc->cfg->current_bss->beacon_period;
1034
1035         if (bi < 2 * TIMER_INTERVAL_WATCHDOG)
1036                 bi = 2 * TIMER_INTERVAL_WATCHDOG;
1037         return bi;
1038 }
1039
1040 /* Change to run the watchdog either from a periodic timer or from tbtt handler.
1041  * Call watchdog from tbtt handler if tbtt is true, watchdog timer otherwise.
1042  */
1043 void wlc_watchdog_upd(wlc_info_t *wlc, bool tbtt)
1044 {
1045         /* make sure changing watchdog driver is allowed */
1046         if (!wlc->pub->up || !wlc->pub->align_wd_tbtt)
1047                 return;
1048         if (!tbtt && wlc->WDarmed) {
1049                 wl_del_timer(wlc->wl, wlc->wdtimer);
1050                 wlc->WDarmed = false;
1051         }
1052
1053         /* stop watchdog timer and use tbtt interrupt to drive watchdog */
1054         if (tbtt && wlc->WDarmed) {
1055                 wl_del_timer(wlc->wl, wlc->wdtimer);
1056                 wlc->WDarmed = false;
1057                 wlc->WDlast = OSL_SYSUPTIME();
1058         }
1059         /* arm watchdog timer and drive the watchdog there */
1060         else if (!tbtt && !wlc->WDarmed) {
1061                 wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG,
1062                              true);
1063                 wlc->WDarmed = true;
1064         }
1065         if (tbtt && !wlc->WDarmed) {
1066                 wl_add_timer(wlc->wl, wlc->wdtimer, wlc_watchdog_backup_bi(wlc),
1067                              true);
1068                 wlc->WDarmed = true;
1069         }
1070 }
1071
1072 ratespec_t wlc_lowest_basic_rspec(wlc_info_t *wlc, wlc_rateset_t *rs)
1073 {
1074         ratespec_t lowest_basic_rspec;
1075         uint i;
1076
1077         /* Use the lowest basic rate */
1078         lowest_basic_rspec = rs->rates[0] & RATE_MASK;
1079         for (i = 0; i < rs->count; i++) {
1080                 if (rs->rates[i] & WLC_RATE_FLAG) {
1081                         lowest_basic_rspec = rs->rates[i] & RATE_MASK;
1082                         break;
1083                 }
1084         }
1085 #if NCONF
1086         /* pick siso/cdd as default for OFDM (note no basic rate MCSs are supported yet) */
1087         if (IS_OFDM(lowest_basic_rspec)) {
1088                 lowest_basic_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
1089         }
1090 #endif
1091
1092         return lowest_basic_rspec;
1093 }
1094
1095 /* This function changes the phytxctl for beacon based on current beacon ratespec AND txant
1096  * setting as per this table:
1097  *  ratespec     CCK            ant = wlc->stf->txant
1098  *              OFDM            ant = 3
1099  */
1100 void wlc_beacon_phytxctl_txant_upd(wlc_info_t *wlc, ratespec_t bcn_rspec)
1101 {
1102         u16 phyctl;
1103         u16 phytxant = wlc->stf->phytxant;
1104         u16 mask = PHY_TXC_ANT_MASK;
1105
1106         /* for non-siso rates or default setting, use the available chains */
1107         if (WLC_PHY_11N_CAP(wlc->band)) {
1108                 phytxant = wlc_stf_phytxchain_sel(wlc, bcn_rspec);
1109         }
1110
1111         phyctl = wlc_read_shm(wlc, M_BCN_PCTLWD);
1112         phyctl = (phyctl & ~mask) | phytxant;
1113         wlc_write_shm(wlc, M_BCN_PCTLWD, phyctl);
1114 }
1115
1116 /* centralized protection config change function to simplify debugging, no consistency checking
1117  * this should be called only on changes to avoid overhead in periodic function
1118 */
1119 void wlc_protection_upd(wlc_info_t *wlc, uint idx, int val)
1120 {
1121         WL_TRACE(("wlc_protection_upd: idx %d, val %d\n", idx, val));
1122
1123         switch (idx) {
1124         case WLC_PROT_G_SPEC:
1125                 wlc->protection->_g = (bool) val;
1126                 break;
1127         case WLC_PROT_G_OVR:
1128                 wlc->protection->g_override = (s8) val;
1129                 break;
1130         case WLC_PROT_G_USER:
1131                 wlc->protection->gmode_user = (u8) val;
1132                 break;
1133         case WLC_PROT_OVERLAP:
1134                 wlc->protection->overlap = (s8) val;
1135                 break;
1136         case WLC_PROT_N_USER:
1137                 wlc->protection->nmode_user = (s8) val;
1138                 break;
1139         case WLC_PROT_N_CFG:
1140                 wlc->protection->n_cfg = (s8) val;
1141                 break;
1142         case WLC_PROT_N_CFG_OVR:
1143                 wlc->protection->n_cfg_override = (s8) val;
1144                 break;
1145         case WLC_PROT_N_NONGF:
1146                 wlc->protection->nongf = (bool) val;
1147                 break;
1148         case WLC_PROT_N_NONGF_OVR:
1149                 wlc->protection->nongf_override = (s8) val;
1150                 break;
1151         case WLC_PROT_N_PAM_OVR:
1152                 wlc->protection->n_pam_override = (s8) val;
1153                 break;
1154         case WLC_PROT_N_OBSS:
1155                 wlc->protection->n_obss = (bool) val;
1156                 break;
1157
1158         default:
1159                 ASSERT(0);
1160                 break;
1161         }
1162
1163 }
1164
1165 static void wlc_ht_update_sgi_rx(wlc_info_t *wlc, int val)
1166 {
1167         wlc->ht_cap.cap &= ~(HT_CAP_SHORT_GI_20 | HT_CAP_SHORT_GI_40);
1168         wlc->ht_cap.cap |= (val & WLC_N_SGI_20) ? HT_CAP_SHORT_GI_20 : 0;
1169         wlc->ht_cap.cap |= (val & WLC_N_SGI_40) ? HT_CAP_SHORT_GI_40 : 0;
1170
1171         if (wlc->pub->up) {
1172                 wlc_update_beacon(wlc);
1173                 wlc_update_probe_resp(wlc, true);
1174         }
1175 }
1176
1177 static void wlc_ht_update_ldpc(wlc_info_t *wlc, s8 val)
1178 {
1179         wlc->stf->ldpc = val;
1180
1181         wlc->ht_cap.cap &= ~HT_CAP_LDPC_CODING;
1182         if (wlc->stf->ldpc != OFF)
1183                 wlc->ht_cap.cap |= HT_CAP_LDPC_CODING;
1184
1185         if (wlc->pub->up) {
1186                 wlc_update_beacon(wlc);
1187                 wlc_update_probe_resp(wlc, true);
1188                 wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
1189         }
1190 }
1191
1192 /*
1193  * ucode, hwmac update
1194  *    Channel dependent updates for ucode and hw
1195  */
1196 static void wlc_ucode_mac_upd(wlc_info_t *wlc)
1197 {
1198         /* enable or disable any active IBSSs depending on whether or not
1199          * we are on the home channel
1200          */
1201         if (wlc->home_chanspec == WLC_BAND_PI_RADIO_CHANSPEC) {
1202                 if (wlc->pub->associated) {
1203                         /* BMAC_NOTE: This is something that should be fixed in ucode inits.
1204                          * I think that the ucode inits set up the bcn templates and shm values
1205                          * with a bogus beacon. This should not be done in the inits. If ucode needs
1206                          * to set up a beacon for testing, the test routines should write it down,
1207                          * not expect the inits to populate a bogus beacon.
1208                          */
1209                         if (WLC_PHY_11N_CAP(wlc->band)) {
1210                                 wlc_write_shm(wlc, M_BCN_TXTSF_OFFSET,
1211                                               wlc->band->bcntsfoff);
1212                         }
1213                 }
1214         } else {
1215                 /* disable an active IBSS if we are not on the home channel */
1216         }
1217
1218         /* update the various promisc bits */
1219         wlc_mac_bcn_promisc(wlc);
1220         wlc_mac_promisc(wlc);
1221 }
1222
1223 static void wlc_bandinit_ordered(wlc_info_t *wlc, chanspec_t chanspec)
1224 {
1225         wlc_rateset_t default_rateset;
1226         uint parkband;
1227         uint i, band_order[2];
1228
1229         WL_TRACE(("wl%d: wlc_bandinit_ordered\n", wlc->pub->unit));
1230         /*
1231          * We might have been bandlocked during down and the chip power-cycled (hibernate).
1232          * figure out the right band to park on
1233          */
1234         if (wlc->bandlocked || NBANDS(wlc) == 1) {
1235                 ASSERT(CHSPEC_WLCBANDUNIT(chanspec) == wlc->band->bandunit);
1236
1237                 parkband = wlc->band->bandunit; /* updated in wlc_bandlock() */
1238                 band_order[0] = band_order[1] = parkband;
1239         } else {
1240                 /* park on the band of the specified chanspec */
1241                 parkband = CHSPEC_WLCBANDUNIT(chanspec);
1242
1243                 /* order so that parkband initialize last */
1244                 band_order[0] = parkband ^ 1;
1245                 band_order[1] = parkband;
1246         }
1247
1248         /* make each band operational, software state init */
1249         for (i = 0; i < NBANDS(wlc); i++) {
1250                 uint j = band_order[i];
1251
1252                 wlc->band = wlc->bandstate[j];
1253
1254                 wlc_default_rateset(wlc, &default_rateset);
1255
1256                 /* fill in hw_rate */
1257                 wlc_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
1258                                    false, WLC_RATES_CCK_OFDM, RATE_MASK,
1259                                    (bool) N_ENAB(wlc->pub));
1260
1261                 /* init basic rate lookup */
1262                 wlc_rate_lookup_init(wlc, &default_rateset);
1263         }
1264
1265         /* sync up phy/radio chanspec */
1266         wlc_set_phy_chanspec(wlc, chanspec);
1267 }
1268
1269 /* band-specific init */
1270 static void WLBANDINITFN(wlc_bsinit) (wlc_info_t *wlc)
1271 {
1272         WL_TRACE(("wl%d: wlc_bsinit: bandunit %d\n", wlc->pub->unit,
1273                   wlc->band->bandunit));
1274
1275         /* write ucode ACK/CTS rate table */
1276         wlc_set_ratetable(wlc);
1277
1278         /* update some band specific mac configuration */
1279         wlc_ucode_mac_upd(wlc);
1280
1281         /* init antenna selection */
1282         if (WLANTSEL_ENAB(wlc))
1283                 wlc_antsel_init(wlc->asi);
1284
1285 }
1286
1287 /* switch to and initialize new band */
1288 static void WLBANDINITFN(wlc_setband) (wlc_info_t *wlc, uint bandunit)
1289 {
1290         int idx;
1291         wlc_bsscfg_t *cfg;
1292
1293         ASSERT(NBANDS(wlc) > 1);
1294         ASSERT(!wlc->bandlocked);
1295         ASSERT(bandunit != wlc->band->bandunit || wlc->bandinit_pending);
1296
1297         wlc->band = wlc->bandstate[bandunit];
1298
1299         if (!wlc->pub->up)
1300                 return;
1301
1302         /* wait for at least one beacon before entering sleeping state */
1303         wlc->PMawakebcn = true;
1304         FOREACH_AS_STA(wlc, idx, cfg)
1305             cfg->PMawakebcn = true;
1306         wlc_set_ps_ctrl(wlc);
1307
1308         /* band-specific initializations */
1309         wlc_bsinit(wlc);
1310 }
1311
1312 /* Initialize a WME Parameter Info Element with default STA parameters from WMM Spec, Table 12 */
1313 void wlc_wme_initparams_sta(wlc_info_t *wlc, wme_param_ie_t *pe)
1314 {
1315         static const wme_param_ie_t stadef = {
1316                 WME_OUI,
1317                 WME_TYPE,
1318                 WME_SUBTYPE_PARAM_IE,
1319                 WME_VER,
1320                 0,
1321                 0,
1322                 {
1323                  {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA,
1324                   HTOL16(EDCF_AC_BE_TXOP_STA)},
1325                  {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA,
1326                   HTOL16(EDCF_AC_BK_TXOP_STA)},
1327                  {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA,
1328                   HTOL16(EDCF_AC_VI_TXOP_STA)},
1329                  {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA,
1330                   HTOL16(EDCF_AC_VO_TXOP_STA)}
1331                  }
1332         };
1333
1334         ASSERT(sizeof(*pe) == WME_PARAM_IE_LEN);
1335         memcpy(pe, &stadef, sizeof(*pe));
1336 }
1337
1338 void wlc_wme_setparams(wlc_info_t *wlc, u16 aci, void *arg, bool suspend)
1339 {
1340         int i;
1341         shm_acparams_t acp_shm;
1342         u16 *shm_entry;
1343         struct ieee80211_tx_queue_params *params = arg;
1344
1345         ASSERT(wlc);
1346
1347         /* Only apply params if the core is out of reset and has clocks */
1348         if (!wlc->clk) {
1349                 WL_ERROR(("wl%d: %s : no-clock\n", wlc->pub->unit, __func__));
1350                 return;
1351         }
1352
1353         /*
1354          * AP uses AC params from wme_param_ie_ap.
1355          * AP advertises AC params from wme_param_ie.
1356          * STA uses AC params from wme_param_ie.
1357          */
1358
1359         wlc->wme_admctl = 0;
1360
1361         do {
1362                 bzero((char *)&acp_shm, sizeof(shm_acparams_t));
1363                 /* find out which ac this set of params applies to */
1364                 ASSERT(aci < AC_COUNT);
1365                 /* set the admission control policy for this AC */
1366                 /* wlc->wme_admctl |= 1 << aci; *//* should be set ??  seems like off by default */
1367
1368                 /* fill in shm ac params struct */
1369                 acp_shm.txop = ltoh16(params->txop);
1370                 /* convert from units of 32us to us for ucode */
1371                 wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
1372                     EDCF_TXOP2USEC(acp_shm.txop);
1373                 acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
1374
1375                 if (aci == AC_VI && acp_shm.txop == 0
1376                     && acp_shm.aifs < EDCF_AIFSN_MAX)
1377                         acp_shm.aifs++;
1378
1379                 if (acp_shm.aifs < EDCF_AIFSN_MIN
1380                     || acp_shm.aifs > EDCF_AIFSN_MAX) {
1381                         WL_ERROR(("wl%d: wlc_edcf_setparams: bad aifs %d\n",
1382                                   wlc->pub->unit, acp_shm.aifs));
1383                         continue;
1384                 }
1385
1386                 acp_shm.cwmin = params->cw_min;
1387                 acp_shm.cwmax = params->cw_max;
1388                 acp_shm.cwcur = acp_shm.cwmin;
1389                 acp_shm.bslots =
1390                     R_REG(wlc->osh, &wlc->regs->tsf_random) & acp_shm.cwcur;
1391                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
1392                 /* Indicate the new params to the ucode */
1393                 acp_shm.status = wlc_read_shm(wlc, (M_EDCF_QINFO +
1394                                                     wme_shmemacindex(aci) *
1395                                                     M_EDCF_QLEN +
1396                                                     M_EDCF_STATUS_OFF));
1397                 acp_shm.status |= WME_STATUS_NEWAC;
1398
1399                 /* Fill in shm acparam table */
1400                 shm_entry = (u16 *) &acp_shm;
1401                 for (i = 0; i < (int)sizeof(shm_acparams_t); i += 2)
1402                         wlc_write_shm(wlc,
1403                                       M_EDCF_QINFO +
1404                                       wme_shmemacindex(aci) * M_EDCF_QLEN + i,
1405                                       *shm_entry++);
1406
1407         } while (0);
1408
1409         if (suspend)
1410                 wlc_suspend_mac_and_wait(wlc);
1411
1412         if (suspend)
1413                 wlc_enable_mac(wlc);
1414
1415 }
1416
1417 void wlc_edcf_setparams(wlc_bsscfg_t *cfg, bool suspend)
1418 {
1419         wlc_info_t *wlc = cfg->wlc;
1420         uint aci, i, j;
1421         edcf_acparam_t *edcf_acp;
1422         shm_acparams_t acp_shm;
1423         u16 *shm_entry;
1424
1425         ASSERT(cfg);
1426         ASSERT(wlc);
1427
1428         /* Only apply params if the core is out of reset and has clocks */
1429         if (!wlc->clk)
1430                 return;
1431
1432         /*
1433          * AP uses AC params from wme_param_ie_ap.
1434          * AP advertises AC params from wme_param_ie.
1435          * STA uses AC params from wme_param_ie.
1436          */
1437
1438         edcf_acp = (edcf_acparam_t *) &wlc->wme_param_ie.acparam[0];
1439
1440         wlc->wme_admctl = 0;
1441
1442         for (i = 0; i < AC_COUNT; i++, edcf_acp++) {
1443                 bzero((char *)&acp_shm, sizeof(shm_acparams_t));
1444                 /* find out which ac this set of params applies to */
1445                 aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
1446                 ASSERT(aci < AC_COUNT);
1447                 /* set the admission control policy for this AC */
1448                 if (edcf_acp->ACI & EDCF_ACM_MASK) {
1449                         wlc->wme_admctl |= 1 << aci;
1450                 }
1451
1452                 /* fill in shm ac params struct */
1453                 acp_shm.txop = ltoh16(edcf_acp->TXOP);
1454                 /* convert from units of 32us to us for ucode */
1455                 wlc->edcf_txop[aci] = acp_shm.txop =
1456                     EDCF_TXOP2USEC(acp_shm.txop);
1457                 acp_shm.aifs = (edcf_acp->ACI & EDCF_AIFSN_MASK);
1458
1459                 if (aci == AC_VI && acp_shm.txop == 0
1460                     && acp_shm.aifs < EDCF_AIFSN_MAX)
1461                         acp_shm.aifs++;
1462
1463                 if (acp_shm.aifs < EDCF_AIFSN_MIN
1464                     || acp_shm.aifs > EDCF_AIFSN_MAX) {
1465                         WL_ERROR(("wl%d: wlc_edcf_setparams: bad aifs %d\n",
1466                                   wlc->pub->unit, acp_shm.aifs));
1467                         continue;
1468                 }
1469
1470                 /* CWmin = 2^(ECWmin) - 1 */
1471                 acp_shm.cwmin = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
1472                 /* CWmax = 2^(ECWmax) - 1 */
1473                 acp_shm.cwmax = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
1474                                             >> EDCF_ECWMAX_SHIFT);
1475                 acp_shm.cwcur = acp_shm.cwmin;
1476                 acp_shm.bslots =
1477                     R_REG(wlc->osh, &wlc->regs->tsf_random) & acp_shm.cwcur;
1478                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
1479                 /* Indicate the new params to the ucode */
1480                 acp_shm.status = wlc_read_shm(wlc, (M_EDCF_QINFO +
1481                                                     wme_shmemacindex(aci) *
1482                                                     M_EDCF_QLEN +
1483                                                     M_EDCF_STATUS_OFF));
1484                 acp_shm.status |= WME_STATUS_NEWAC;
1485
1486                 /* Fill in shm acparam table */
1487                 shm_entry = (u16 *) &acp_shm;
1488                 for (j = 0; j < (int)sizeof(shm_acparams_t); j += 2)
1489                         wlc_write_shm(wlc,
1490                                       M_EDCF_QINFO +
1491                                       wme_shmemacindex(aci) * M_EDCF_QLEN + j,
1492                                       *shm_entry++);
1493         }
1494
1495         if (suspend)
1496                 wlc_suspend_mac_and_wait(wlc);
1497
1498         if (AP_ENAB(wlc->pub) && WME_ENAB(wlc->pub)) {
1499                 wlc_update_beacon(wlc);
1500                 wlc_update_probe_resp(wlc, false);
1501         }
1502
1503         if (suspend)
1504                 wlc_enable_mac(wlc);
1505
1506 }
1507
1508 bool wlc_timers_init(wlc_info_t *wlc, int unit)
1509 {
1510         wlc->wdtimer = wl_init_timer(wlc->wl, wlc_watchdog_by_timer,
1511                 wlc, "watchdog");
1512         if (!wlc->wdtimer) {
1513                 WL_ERROR(("wl%d:  wl_init_timer for wdtimer failed\n", unit));
1514                 goto fail;
1515         }
1516
1517         wlc->radio_timer = wl_init_timer(wlc->wl, wlc_radio_timer,
1518                 wlc, "radio");
1519         if (!wlc->radio_timer) {
1520                 WL_ERROR(("wl%d:  wl_init_timer for radio_timer failed\n",
1521                           unit));
1522                 goto fail;
1523         }
1524
1525         return true;
1526
1527  fail:
1528         return false;
1529 }
1530
1531 /*
1532  * Initialize wlc_info default values ...
1533  * may get overrides later in this function
1534  */
1535 void wlc_info_init(wlc_info_t *wlc, int unit)
1536 {
1537         int i;
1538         /* Assume the device is there until proven otherwise */
1539         wlc->device_present = true;
1540
1541         /* set default power output percentage to 100 percent */
1542         wlc->txpwr_percent = 100;
1543
1544         /* Save our copy of the chanspec */
1545         wlc->chanspec = CH20MHZ_CHSPEC(1);
1546
1547         /* initialize CCK preamble mode to unassociated state */
1548         wlc->shortpreamble = false;
1549
1550         wlc->legacy_probe = true;
1551
1552         /* various 802.11g modes */
1553         wlc->shortslot = false;
1554         wlc->shortslot_override = WLC_SHORTSLOT_AUTO;
1555
1556         wlc->barker_overlap_control = true;
1557         wlc->barker_preamble = WLC_BARKER_SHORT_ALLOWED;
1558         wlc->txburst_limit_override = AUTO;
1559
1560         wlc_protection_upd(wlc, WLC_PROT_G_OVR, WLC_PROTECTION_AUTO);
1561         wlc_protection_upd(wlc, WLC_PROT_G_SPEC, false);
1562
1563         wlc_protection_upd(wlc, WLC_PROT_N_CFG_OVR, WLC_PROTECTION_AUTO);
1564         wlc_protection_upd(wlc, WLC_PROT_N_CFG, WLC_N_PROTECTION_OFF);
1565         wlc_protection_upd(wlc, WLC_PROT_N_NONGF_OVR, WLC_PROTECTION_AUTO);
1566         wlc_protection_upd(wlc, WLC_PROT_N_NONGF, false);
1567         wlc_protection_upd(wlc, WLC_PROT_N_PAM_OVR, AUTO);
1568
1569         wlc_protection_upd(wlc, WLC_PROT_OVERLAP, WLC_PROTECTION_CTL_OVERLAP);
1570
1571         /* 802.11g draft 4.0 NonERP elt advertisement */
1572         wlc->include_legacy_erp = true;
1573
1574         wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
1575         wlc->stf->txant = ANT_TX_DEF;
1576
1577         wlc->prb_resp_timeout = WLC_PRB_RESP_TIMEOUT;
1578
1579         wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
1580         for (i = 0; i < NFIFO; i++)
1581                 wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
1582         wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
1583
1584         /* default rate fallback retry limits */
1585         wlc->SFBL = RETRY_SHORT_FB;
1586         wlc->LFBL = RETRY_LONG_FB;
1587
1588         /* default mac retry limits */
1589         wlc->SRL = RETRY_SHORT_DEF;
1590         wlc->LRL = RETRY_LONG_DEF;
1591
1592         /* init PM state */
1593         wlc->PM = PM_OFF;       /* User's setting of PM mode through IOCTL */
1594         wlc->PM_override = false;       /* Prevents from going to PM if our AP is 'ill' */
1595         wlc->PMenabled = false; /* Current PM state */
1596         wlc->PMpending = false; /* Tracks whether STA indicated PM in the last attempt */
1597         wlc->PMblocked = false; /* To allow blocking going into PM during RM and scans */
1598
1599         /* In WMM Auto mode, PM is allowed if association is a UAPSD association */
1600         wlc->WME_PM_blocked = false;
1601
1602         /* Init wme queuing method */
1603         wlc->wme_prec_queuing = false;
1604
1605         /* Overrides for the core to stay awake under zillion conditions Look for STAY_AWAKE */
1606         wlc->wake = false;
1607         /* Are we waiting for a response to PS-Poll that we sent */
1608         wlc->PSpoll = false;
1609
1610         /* APSD defaults */
1611         wlc->wme_apsd = true;
1612         wlc->apsd_sta_usp = false;
1613         wlc->apsd_trigger_timeout = 0;  /* disable the trigger timer */
1614         wlc->apsd_trigger_ac = AC_BITMAP_ALL;
1615
1616         /* Set flag to indicate that hw keys should be used when available. */
1617         wlc->wsec_swkeys = false;
1618
1619         /* init the 4 static WEP default keys */
1620         for (i = 0; i < WSEC_MAX_DEFAULT_KEYS; i++) {
1621                 wlc->wsec_keys[i] = wlc->wsec_def_keys[i];
1622                 wlc->wsec_keys[i]->idx = (u8) i;
1623         }
1624
1625         wlc->_regulatory_domain = false;        /* 802.11d */
1626
1627         /* WME QoS mode is Auto by default */
1628         wlc->pub->_wme = AUTO;
1629
1630 #ifdef BCMSDIODEV_ENABLED
1631         wlc->pub->_priofc = true;       /* enable priority flow control for sdio dongle */
1632 #endif
1633
1634         wlc->pub->_ampdu = AMPDU_AGG_HOST;
1635         wlc->pub->bcmerror = 0;
1636         wlc->ibss_allowed = true;
1637         wlc->ibss_coalesce_allowed = true;
1638         wlc->pub->_coex = ON;
1639
1640         /* intialize mpc delay */
1641         wlc->mpc_delay_off = wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
1642
1643         wlc->pr80838_war = true;
1644 }
1645
1646 static bool wlc_state_bmac_sync(wlc_info_t *wlc)
1647 {
1648         wlc_bmac_state_t state_bmac;
1649
1650         if (wlc_bmac_state_get(wlc->hw, &state_bmac) != 0)
1651                 return false;
1652
1653         wlc->machwcap = state_bmac.machwcap;
1654         wlc_protection_upd(wlc, WLC_PROT_N_PAM_OVR,
1655                            (s8) state_bmac.preamble_ovr);
1656
1657         return true;
1658 }
1659
1660 static uint wlc_attach_module(wlc_info_t *wlc)
1661 {
1662         uint err = 0;
1663         uint unit;
1664         unit = wlc->pub->unit;
1665
1666         wlc->asi = wlc_antsel_attach(wlc, wlc->osh, wlc->pub, wlc->hw);
1667         if (wlc->asi == NULL) {
1668                 WL_ERROR(("wl%d: wlc_attach: wlc_antsel_attach failed\n",
1669                           unit));
1670                 err = 44;
1671                 goto fail;
1672         }
1673
1674         wlc->ampdu = wlc_ampdu_attach(wlc);
1675         if (wlc->ampdu == NULL) {
1676                 WL_ERROR(("wl%d: wlc_attach: wlc_ampdu_attach failed\n", unit));
1677                 err = 50;
1678                 goto fail;
1679         }
1680
1681         /* Initialize event queue; needed before following calls */
1682         wlc->eventq =
1683             wlc_eventq_attach(wlc->pub, wlc, wlc->wl, wlc_process_eventq);
1684         if (wlc->eventq == NULL) {
1685                 WL_ERROR(("wl%d: wlc_attach: wlc_eventq_attachfailed\n", unit));
1686                 err = 57;
1687                 goto fail;
1688         }
1689
1690         if ((wlc_stf_attach(wlc) != 0)) {
1691                 WL_ERROR(("wl%d: wlc_attach: wlc_stf_attach failed\n", unit));
1692                 err = 68;
1693                 goto fail;
1694         }
1695  fail:
1696         return err;
1697 }
1698
1699 wlc_pub_t *wlc_pub(void *wlc)
1700 {
1701         return ((wlc_info_t *) wlc)->pub;
1702 }
1703
1704 #define CHIP_SUPPORTS_11N(wlc)  1
1705
1706 /*
1707  * The common driver entry routine. Error codes should be unique
1708  */
1709 void *wlc_attach(void *wl, u16 vendor, u16 device, uint unit, bool piomode,
1710                  struct osl_info *osh, void *regsva, uint bustype,
1711                  void *btparam, uint *perr)
1712 {
1713         wlc_info_t *wlc;
1714         uint err = 0;
1715         uint j;
1716         wlc_pub_t *pub;
1717         wlc_txq_info_t *qi;
1718         uint n_disabled;
1719
1720         WL_NONE(("wl%d: %s: vendor 0x%x device 0x%x\n", unit, __func__, vendor,
1721                  device));
1722
1723         ASSERT(WSEC_MAX_RCMTA_KEYS <= WSEC_MAX_KEYS);
1724         ASSERT(WSEC_MAX_DEFAULT_KEYS == WLC_DEFAULT_KEYS);
1725
1726         /* some code depends on packed structures */
1727         ASSERT(sizeof(struct ether_addr) == ETHER_ADDR_LEN);
1728         ASSERT(sizeof(struct ether_header) == ETHER_HDR_LEN);
1729         ASSERT(sizeof(d11regs_t) == SI_CORE_SIZE);
1730         ASSERT(sizeof(ofdm_phy_hdr_t) == D11_PHY_HDR_LEN);
1731         ASSERT(sizeof(cck_phy_hdr_t) == D11_PHY_HDR_LEN);
1732         ASSERT(sizeof(d11txh_t) == D11_TXH_LEN);
1733         ASSERT(sizeof(d11rxhdr_t) == RXHDR_LEN);
1734         ASSERT(sizeof(struct dot11_header) == DOT11_A4_HDR_LEN);
1735         ASSERT(sizeof(struct dot11_rts_frame) == DOT11_RTS_LEN);
1736         ASSERT(sizeof(struct dot11_management_header) == DOT11_MGMT_HDR_LEN);
1737         ASSERT(sizeof(struct dot11_bcn_prb) == DOT11_BCN_PRB_LEN);
1738         ASSERT(sizeof(tx_status_t) == TXSTATUS_LEN);
1739         ASSERT(sizeof(ht_cap_ie_t) == HT_CAP_IE_LEN);
1740 #ifdef BRCM_FULLMAC
1741         ASSERT(offsetof(wl_scan_params_t, channel_list) ==
1742                WL_SCAN_PARAMS_FIXED_SIZE);
1743 #endif
1744         ASSERT(IS_ALIGNED(offsetof(wsec_key_t, data), sizeof(u32)));
1745         ASSERT(ISPOWEROF2(MA_WINDOW_SZ));
1746
1747         ASSERT(sizeof(wlc_d11rxhdr_t) <= WL_HWRXOFF);
1748
1749         /*
1750          * Number of replay counters value used in WPA IE must match # rxivs
1751          * supported in wsec_key_t struct. See 802.11i/D3.0 sect. 7.3.2.17
1752          * 'RSN Information Element' figure 8 for this mapping.
1753          */
1754         ASSERT((WPA_CAP_16_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
1755                 && 16 == WLC_NUMRXIVS)
1756                || (WPA_CAP_4_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
1757                    && 4 == WLC_NUMRXIVS));
1758
1759         /* allocate wlc_info_t state and its substructures */
1760         wlc = (wlc_info_t *) wlc_attach_malloc(osh, unit, &err, device);
1761         if (wlc == NULL)
1762                 goto fail;
1763         wlc->osh = osh;
1764         pub = wlc->pub;
1765
1766 #if defined(BCMDBG)
1767         wlc_info_dbg = wlc;
1768 #endif
1769
1770         wlc->band = wlc->bandstate[0];
1771         wlc->core = wlc->corestate;
1772         wlc->wl = wl;
1773         pub->unit = unit;
1774         pub->osh = osh;
1775         wlc->btparam = btparam;
1776         pub->_piomode = piomode;
1777         wlc->bandinit_pending = false;
1778         /* By default restrict TKIP associations from 11n STA's */
1779         wlc->ht_wsec_restriction = WLC_HT_TKIP_RESTRICT;
1780
1781         /* populate wlc_info_t with default values  */
1782         wlc_info_init(wlc, unit);
1783
1784         /* update sta/ap related parameters */
1785         wlc_ap_upd(wlc);
1786
1787         /* 11n_disable nvram */
1788         n_disabled = getintvar(pub->vars, "11n_disable");
1789
1790         /* register a module (to handle iovars) */
1791         wlc_module_register(wlc->pub, wlc_iovars, "wlc_iovars", wlc,
1792                             wlc_doiovar, NULL, NULL);
1793
1794         /* low level attach steps(all hw accesses go inside, no more in rest of the attach) */
1795         err = wlc_bmac_attach(wlc, vendor, device, unit, piomode, osh, regsva,
1796                               bustype, btparam);
1797         if (err)
1798                 goto fail;
1799
1800         /* for some states, due to different info pointer(e,g, wlc, wlc_hw) or master/slave split,
1801          * HIGH driver(both monolithic and HIGH_ONLY) needs to sync states FROM BMAC portion driver
1802          */
1803         if (!wlc_state_bmac_sync(wlc)) {
1804                 err = 20;
1805                 goto fail;
1806         }
1807
1808         pub->phy_11ncapable = WLC_PHY_11N_CAP(wlc->band);
1809
1810         /* propagate *vars* from BMAC driver to high driver */
1811         wlc_bmac_copyfrom_vars(wlc->hw, &pub->vars, &wlc->vars_size);
1812
1813
1814         /* set maximum allowed duty cycle */
1815         wlc->tx_duty_cycle_ofdm =
1816             (u16) getintvar(pub->vars, "tx_duty_cycle_ofdm");
1817         wlc->tx_duty_cycle_cck =
1818             (u16) getintvar(pub->vars, "tx_duty_cycle_cck");
1819
1820         wlc_stf_phy_chain_calc(wlc);
1821
1822         /* txchain 1: txant 0, txchain 2: txant 1 */
1823         if (WLCISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
1824                 wlc->stf->txant = wlc->stf->hw_txchain - 1;
1825
1826         /* push to BMAC driver */
1827         wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
1828                                wlc->stf->hw_rxchain);
1829
1830         /* pull up some info resulting from the low attach */
1831         {
1832                 int i;
1833                 for (i = 0; i < NFIFO; i++)
1834                         wlc->core->txavail[i] = wlc->hw->txavail[i];
1835         }
1836
1837         wlc_bmac_hw_etheraddr(wlc->hw, &wlc->perm_etheraddr);
1838
1839         bcopy((char *)&wlc->perm_etheraddr, (char *)&pub->cur_etheraddr,
1840               ETHER_ADDR_LEN);
1841
1842         for (j = 0; j < NBANDS(wlc); j++) {
1843                 /* Use band 1 for single band 11a */
1844                 if (IS_SINGLEBAND_5G(wlc->deviceid))
1845                         j = BAND_5G_INDEX;
1846
1847                 wlc->band = wlc->bandstate[j];
1848
1849                 if (!wlc_attach_stf_ant_init(wlc)) {
1850                         err = 24;
1851                         goto fail;
1852                 }
1853
1854                 /* default contention windows size limits */
1855                 wlc->band->CWmin = APHY_CWMIN;
1856                 wlc->band->CWmax = PHY_CWMAX;
1857
1858                 /* init gmode value */
1859                 if (BAND_2G(wlc->band->bandtype)) {
1860                         wlc->band->gmode = GMODE_AUTO;
1861                         wlc_protection_upd(wlc, WLC_PROT_G_USER,
1862                                            wlc->band->gmode);
1863                 }
1864
1865                 /* init _n_enab supported mode */
1866                 if (WLC_PHY_11N_CAP(wlc->band) && CHIP_SUPPORTS_11N(wlc)) {
1867                         if (n_disabled & WLFEATURE_DISABLE_11N) {
1868                                 pub->_n_enab = OFF;
1869                                 wlc_protection_upd(wlc, WLC_PROT_N_USER, OFF);
1870                         } else {
1871                                 pub->_n_enab = SUPPORT_11N;
1872                                 wlc_protection_upd(wlc, WLC_PROT_N_USER,
1873                                                    ((pub->_n_enab ==
1874                                                      SUPPORT_11N) ? WL_11N_2x2 :
1875                                                     WL_11N_3x3));
1876                         }
1877                 }
1878
1879                 /* init per-band default rateset, depend on band->gmode */
1880                 wlc_default_rateset(wlc, &wlc->band->defrateset);
1881
1882                 /* fill in hw_rateset (used early by WLC_SET_RATESET) */
1883                 wlc_rateset_filter(&wlc->band->defrateset,
1884                                    &wlc->band->hw_rateset, false,
1885                                    WLC_RATES_CCK_OFDM, RATE_MASK,
1886                                    (bool) N_ENAB(wlc->pub));
1887         }
1888
1889         /* update antenna config due to wlc->stf->txant/txchain/ant_rx_ovr change */
1890         wlc_stf_phy_txant_upd(wlc);
1891
1892         /* attach each modules */
1893         err = wlc_attach_module(wlc);
1894         if (err != 0)
1895                 goto fail;
1896
1897         if (!wlc_timers_init(wlc, unit)) {
1898                 WL_ERROR(("wl%d: %s: wlc_init_timer failed\n", unit, __func__));
1899                 err = 32;
1900                 goto fail;
1901         }
1902
1903         /* depend on rateset, gmode */
1904         wlc->cmi = wlc_channel_mgr_attach(wlc);
1905         if (!wlc->cmi) {
1906                 WL_ERROR(("wl%d: %s: wlc_channel_mgr_attach failed\n", unit,
1907                           __func__));
1908                 err = 33;
1909                 goto fail;
1910         }
1911
1912         /* init default when all parameters are ready, i.e. ->rateset */
1913         wlc_bss_default_init(wlc);
1914
1915         /*
1916          * Complete the wlc default state initializations..
1917          */
1918
1919         /* allocate our initial queue */
1920         qi = wlc_txq_alloc(wlc, osh);
1921         if (qi == NULL) {
1922                 WL_ERROR(("wl%d: %s: failed to malloc tx queue\n", unit,
1923                           __func__));
1924                 err = 100;
1925                 goto fail;
1926         }
1927         wlc->active_queue = qi;
1928
1929         wlc->bsscfg[0] = wlc->cfg;
1930         wlc->cfg->_idx = 0;
1931         wlc->cfg->wlc = wlc;
1932         pub->txmaxpkts = MAXTXPKTS;
1933
1934         WLCNTSET(pub->_cnt->version, WL_CNT_T_VERSION);
1935         WLCNTSET(pub->_cnt->length, sizeof(wl_cnt_t));
1936
1937         WLCNTSET(pub->_wme_cnt->version, WL_WME_CNT_VERSION);
1938         WLCNTSET(pub->_wme_cnt->length, sizeof(wl_wme_cnt_t));
1939
1940         wlc_wme_initparams_sta(wlc, &wlc->wme_param_ie);
1941
1942         wlc->mimoft = FT_HT;
1943         wlc->ht_cap.cap = HT_CAP;
1944         if (HT_ENAB(wlc->pub))
1945                 wlc->stf->ldpc = AUTO;
1946
1947         wlc->mimo_40txbw = AUTO;
1948         wlc->ofdm_40txbw = AUTO;
1949         wlc->cck_40txbw = AUTO;
1950         wlc_update_mimo_band_bwcap(wlc, WLC_N_BW_20IN2G_40IN5G);
1951
1952         /* Enable setting the RIFS Mode bit by default in HT Info IE */
1953         wlc->rifs_advert = AUTO;
1954
1955         /* Set default values of SGI */
1956         if (WLC_SGI_CAP_PHY(wlc)) {
1957                 wlc_ht_update_sgi_rx(wlc, (WLC_N_SGI_20 | WLC_N_SGI_40));
1958                 wlc->sgi_tx = AUTO;
1959         } else if (WLCISSSLPNPHY(wlc->band)) {
1960                 wlc_ht_update_sgi_rx(wlc, (WLC_N_SGI_20 | WLC_N_SGI_40));
1961                 wlc->sgi_tx = AUTO;
1962         } else {
1963                 wlc_ht_update_sgi_rx(wlc, 0);
1964                 wlc->sgi_tx = OFF;
1965         }
1966
1967         /* *******nvram 11n config overrides Start ********* */
1968
1969         /* apply the sgi override from nvram conf */
1970         if (n_disabled & WLFEATURE_DISABLE_11N_SGI_TX)
1971                 wlc->sgi_tx = OFF;
1972
1973         if (n_disabled & WLFEATURE_DISABLE_11N_SGI_RX)
1974                 wlc_ht_update_sgi_rx(wlc, 0);
1975
1976         /* apply the stbc override from nvram conf */
1977         if (n_disabled & WLFEATURE_DISABLE_11N_STBC_TX) {
1978                 wlc->bandstate[BAND_2G_INDEX]->band_stf_stbc_tx = OFF;
1979                 wlc->bandstate[BAND_5G_INDEX]->band_stf_stbc_tx = OFF;
1980                 wlc->ht_cap.cap &= ~HT_CAP_TX_STBC;
1981         }
1982         if (n_disabled & WLFEATURE_DISABLE_11N_STBC_RX)
1983                 wlc_stf_stbc_rx_set(wlc, HT_CAP_RX_STBC_NO);
1984
1985         /* apply the GF override from nvram conf */
1986         if (n_disabled & WLFEATURE_DISABLE_11N_GF)
1987                 wlc->ht_cap.cap &= ~HT_CAP_GF;
1988
1989         /* initialize radio_mpc_disable according to wlc->mpc */
1990         wlc_radio_mpc_upd(wlc);
1991
1992         if (WLANTSEL_ENAB(wlc)) {
1993                 if ((CHIPID(wlc->pub->sih->chip)) == BCM43235_CHIP_ID) {
1994                         if ((getintvar(wlc->pub->vars, "aa2g") == 7) ||
1995                             (getintvar(wlc->pub->vars, "aa5g") == 7)) {
1996                                 wlc_bmac_antsel_set(wlc->hw, 1);
1997                         }
1998                 } else {
1999                         wlc_bmac_antsel_set(wlc->hw, wlc->asi->antsel_avail);
2000                 }
2001         }
2002
2003         if (perr)
2004                 *perr = 0;
2005
2006         return (void *)wlc;
2007
2008  fail:
2009         WL_ERROR(("wl%d: %s: failed with err %d\n", unit, __func__, err));
2010         if (wlc)
2011                 wlc_detach(wlc);
2012
2013         if (perr)
2014                 *perr = err;
2015         return NULL;
2016 }
2017
2018 static void wlc_attach_antgain_init(wlc_info_t *wlc)
2019 {
2020         uint unit;
2021         unit = wlc->pub->unit;
2022
2023         if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
2024                 /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
2025                 wlc->band->antgain = 8;
2026         } else if (wlc->band->antgain == -1) {
2027                 WL_ERROR(("wl%d: %s: Invalid antennas available in srom, using 2dB\n", unit, __func__));
2028                 wlc->band->antgain = 8;
2029         } else {
2030                 s8 gain, fract;
2031                 /* Older sroms specified gain in whole dbm only.  In order
2032                  * be able to specify qdbm granularity and remain backward compatible
2033                  * the whole dbms are now encoded in only low 6 bits and remaining qdbms
2034                  * are encoded in the hi 2 bits. 6 bit signed number ranges from
2035                  * -32 - 31. Examples: 0x1 = 1 db,
2036                  * 0xc1 = 1.75 db (1 + 3 quarters),
2037                  * 0x3f = -1 (-1 + 0 quarters),
2038                  * 0x7f = -.75 (-1 in low 6 bits + 1 quarters in hi 2 bits) = -3 qdbm.
2039                  * 0xbf = -.50 (-1 in low 6 bits + 2 quarters in hi 2 bits) = -2 qdbm.
2040                  */
2041                 gain = wlc->band->antgain & 0x3f;
2042                 gain <<= 2;     /* Sign extend */
2043                 gain >>= 2;
2044                 fract = (wlc->band->antgain & 0xc0) >> 6;
2045                 wlc->band->antgain = 4 * gain + fract;
2046         }
2047 }
2048
2049 static bool wlc_attach_stf_ant_init(wlc_info_t *wlc)
2050 {
2051         int aa;
2052         uint unit;
2053         char *vars;
2054         int bandtype;
2055
2056         unit = wlc->pub->unit;
2057         vars = wlc->pub->vars;
2058         bandtype = wlc->band->bandtype;
2059
2060         /* get antennas available */
2061         aa = (s8) getintvar(vars, (BAND_5G(bandtype) ? "aa5g" : "aa2g"));
2062         if (aa == 0)
2063                 aa = (s8) getintvar(vars,
2064                                       (BAND_5G(bandtype) ? "aa1" : "aa0"));
2065         if ((aa < 1) || (aa > 15)) {
2066                 WL_ERROR(("wl%d: %s: Invalid antennas available in srom (0x%x), using 3.\n", unit, __func__, aa));
2067                 aa = 3;
2068         }
2069
2070         /* reset the defaults if we have a single antenna */
2071         if (aa == 1) {
2072                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
2073                 wlc->stf->txant = ANT_TX_FORCE_0;
2074         } else if (aa == 2) {
2075                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
2076                 wlc->stf->txant = ANT_TX_FORCE_1;
2077         } else {
2078         }
2079
2080         /* Compute Antenna Gain */
2081         wlc->band->antgain =
2082             (s8) getintvar(vars, (BAND_5G(bandtype) ? "ag1" : "ag0"));
2083         wlc_attach_antgain_init(wlc);
2084
2085         return true;
2086 }
2087
2088
2089 static void wlc_timers_deinit(wlc_info_t *wlc)
2090 {
2091         /* free timer state */
2092         if (wlc->wdtimer) {
2093                 wl_free_timer(wlc->wl, wlc->wdtimer);
2094                 wlc->wdtimer = NULL;
2095         }
2096         if (wlc->radio_timer) {
2097                 wl_free_timer(wlc->wl, wlc->radio_timer);
2098                 wlc->radio_timer = NULL;
2099         }
2100 }
2101
2102 static void wlc_detach_module(wlc_info_t *wlc)
2103 {
2104         if (wlc->asi) {
2105                 wlc_antsel_detach(wlc->asi);
2106                 wlc->asi = NULL;
2107         }
2108
2109         if (wlc->ampdu) {
2110                 wlc_ampdu_detach(wlc->ampdu);
2111                 wlc->ampdu = NULL;
2112         }
2113
2114         wlc_stf_detach(wlc);
2115 }
2116
2117 /*
2118  * Return a count of the number of driver callbacks still pending.
2119  *
2120  * General policy is that wlc_detach can only dealloc/free software states. It can NOT
2121  *  touch hardware registers since the d11core may be in reset and clock may not be available.
2122  *    One exception is sb register access, which is possible if crystal is turned on
2123  * After "down" state, driver should avoid software timer with the exception of radio_monitor.
2124  */
2125 uint wlc_detach(wlc_info_t *wlc)
2126 {
2127         uint i;
2128         uint callbacks = 0;
2129
2130         if (wlc == NULL)
2131                 return 0;
2132
2133         WL_TRACE(("wl%d: %s\n", wlc->pub->unit, __func__));
2134
2135         ASSERT(!wlc->pub->up);
2136
2137         callbacks += wlc_bmac_detach(wlc);
2138
2139         /* delete software timers */
2140         if (!wlc_radio_monitor_stop(wlc))
2141                 callbacks++;
2142
2143         if (wlc->eventq) {
2144                 wlc_eventq_detach(wlc->eventq);
2145                 wlc->eventq = NULL;
2146         }
2147
2148         wlc_channel_mgr_detach(wlc->cmi);
2149
2150         wlc_timers_deinit(wlc);
2151
2152         wlc_detach_module(wlc);
2153
2154         /* free other state */
2155
2156
2157 #ifdef BCMDBG
2158         if (wlc->country_ie_override) {
2159                 kfree(wlc->country_ie_override);
2160                 wlc->country_ie_override = NULL;
2161         }
2162 #endif                          /* BCMDBG */
2163
2164         {
2165                 /* free dumpcb list */
2166                 dumpcb_t *prev, *ptr;
2167                 prev = ptr = wlc->dumpcb_head;
2168                 while (ptr) {
2169                         ptr = prev->next;
2170                         kfree(prev);
2171                         prev = ptr;
2172                 }
2173                 wlc->dumpcb_head = NULL;
2174         }
2175
2176         /* Detach from iovar manager */
2177         wlc_module_unregister(wlc->pub, "wlc_iovars", wlc);
2178
2179         /*
2180            if (wlc->ap) {
2181            wlc_ap_detach(wlc->ap);
2182            wlc->ap = NULL;
2183            }
2184          */
2185
2186         while (wlc->tx_queues != NULL) {
2187                 wlc_txq_free(wlc, wlc->osh, wlc->tx_queues);
2188         }
2189
2190         /*
2191          * consistency check: wlc_module_register/wlc_module_unregister calls
2192          * should match therefore nothing should be left here.
2193          */
2194         for (i = 0; i < WLC_MAXMODULES; i++)
2195                 ASSERT(wlc->modulecb[i].name[0] == '\0');
2196
2197         wlc_detach_mfree(wlc, wlc->osh);
2198         return callbacks;
2199 }
2200
2201 /* update state that depends on the current value of "ap" */
2202 void wlc_ap_upd(wlc_info_t *wlc)
2203 {
2204         if (AP_ENAB(wlc->pub))
2205                 wlc->PLCPHdr_override = WLC_PLCP_AUTO;  /* AP: short not allowed, but not enforced */
2206         else
2207                 wlc->PLCPHdr_override = WLC_PLCP_SHORT; /* STA-BSS; short capable */
2208
2209         /* disable vlan_mode on AP since some legacy STAs cannot rx tagged pkts */
2210         wlc->vlan_mode = AP_ENAB(wlc->pub) ? OFF : AUTO;
2211
2212         /* fixup mpc */
2213         wlc->mpc = true;
2214 }
2215
2216 /* read hwdisable state and propagate to wlc flag */
2217 static void wlc_radio_hwdisable_upd(wlc_info_t *wlc)
2218 {
2219         if (wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO || wlc->pub->hw_off)
2220                 return;
2221
2222         if (wlc_bmac_radio_read_hwdisabled(wlc->hw)) {
2223                 mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
2224         } else {
2225                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
2226         }
2227 }
2228
2229 /* return true if Minimum Power Consumption should be entered, false otherwise */
2230 bool wlc_is_non_delay_mpc(wlc_info_t *wlc)
2231 {
2232         return false;
2233 }
2234
2235 bool wlc_ismpc(wlc_info_t *wlc)
2236 {
2237         return (wlc->mpc_delay_off == 0) && (wlc_is_non_delay_mpc(wlc));
2238 }
2239
2240 void wlc_radio_mpc_upd(wlc_info_t *wlc)
2241 {
2242         bool mpc_radio, radio_state;
2243
2244         /*
2245          * Clear the WL_RADIO_MPC_DISABLE bit when mpc feature is disabled
2246          * in case the WL_RADIO_MPC_DISABLE bit was set. Stop the radio
2247          * monitor also when WL_RADIO_MPC_DISABLE is the only reason that
2248          * the radio is going down.
2249          */
2250         if (!wlc->mpc) {
2251                 if (!wlc->pub->radio_disabled)
2252                         return;
2253                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE);
2254                 wlc_radio_upd(wlc);
2255                 if (!wlc->pub->radio_disabled)
2256                         wlc_radio_monitor_stop(wlc);
2257                 return;
2258         }
2259
2260         /*
2261          * sync ismpc logic with WL_RADIO_MPC_DISABLE bit in wlc->pub->radio_disabled
2262          * to go ON, always call radio_upd synchronously
2263          * to go OFF, postpone radio_upd to later when context is safe(e.g. watchdog)
2264          */
2265         radio_state =
2266             (mboolisset(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE) ? OFF :
2267              ON);
2268         mpc_radio = (wlc_ismpc(wlc) == true) ? OFF : ON;
2269
2270         if (radio_state == ON && mpc_radio == OFF)
2271                 wlc->mpc_delay_off = wlc->mpc_dlycnt;
2272         else if (radio_state == OFF && mpc_radio == ON) {
2273                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE);
2274                 wlc_radio_upd(wlc);
2275                 if (wlc->mpc_offcnt < WLC_MPC_THRESHOLD) {
2276                         wlc->mpc_dlycnt = WLC_MPC_MAX_DELAYCNT;
2277                 } else
2278                         wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
2279                 wlc->mpc_dur += OSL_SYSUPTIME() - wlc->mpc_laston_ts;
2280         }
2281         /* Below logic is meant to capture the transition from mpc off to mpc on for reasons
2282          * other than wlc->mpc_delay_off keeping the mpc off. In that case reset
2283          * wlc->mpc_delay_off to wlc->mpc_dlycnt, so that we restart the countdown of mpc_delay_off
2284          */
2285         if ((wlc->prev_non_delay_mpc == false) &&
2286             (wlc_is_non_delay_mpc(wlc) == true) && wlc->mpc_delay_off) {
2287                 wlc->mpc_delay_off = wlc->mpc_dlycnt;
2288         }
2289         wlc->prev_non_delay_mpc = wlc_is_non_delay_mpc(wlc);
2290 }
2291
2292 /*
2293  * centralized radio disable/enable function,
2294  * invoke radio enable/disable after updating hwradio status
2295  */
2296 static void wlc_radio_upd(wlc_info_t *wlc)
2297 {
2298         if (wlc->pub->radio_disabled)
2299                 wlc_radio_disable(wlc);
2300         else
2301                 wlc_radio_enable(wlc);
2302 }
2303
2304 /* maintain LED behavior in down state */
2305 static void wlc_down_led_upd(wlc_info_t *wlc)
2306 {
2307         ASSERT(!wlc->pub->up);
2308
2309         /* maintain LEDs while in down state, turn on sbclk if not available yet */
2310         /* turn on sbclk if necessary */
2311         if (!AP_ENAB(wlc->pub)) {
2312                 wlc_pllreq(wlc, true, WLC_PLLREQ_FLIP);
2313
2314                 wlc_pllreq(wlc, false, WLC_PLLREQ_FLIP);
2315         }
2316 }
2317
2318 void wlc_radio_disable(wlc_info_t *wlc)
2319 {
2320         if (!wlc->pub->up) {
2321                 wlc_down_led_upd(wlc);
2322                 return;
2323         }
2324
2325         wlc_radio_monitor_start(wlc);
2326         wl_down(wlc->wl);
2327 }
2328
2329 static void wlc_radio_enable(wlc_info_t *wlc)
2330 {
2331         if (wlc->pub->up)
2332                 return;
2333
2334         if (DEVICEREMOVED(wlc))
2335                 return;
2336
2337         if (!wlc->down_override) {      /* imposed by wl down/out ioctl */
2338                 wl_up(wlc->wl);
2339         }
2340 }
2341
2342 /* periodical query hw radio button while driver is "down" */
2343 static void wlc_radio_timer(void *arg)
2344 {
2345         wlc_info_t *wlc = (wlc_info_t *) arg;
2346
2347         if (DEVICEREMOVED(wlc)) {
2348                 WL_ERROR(("wl%d: %s: dead chip\n", wlc->pub->unit, __func__));
2349                 wl_down(wlc->wl);
2350                 return;
2351         }
2352
2353         /* cap mpc off count */
2354         if (wlc->mpc_offcnt < WLC_MPC_MAX_DELAYCNT)
2355                 wlc->mpc_offcnt++;
2356
2357         /* validate all the reasons driver could be down and running this radio_timer */
2358         ASSERT(wlc->pub->radio_disabled || wlc->down_override);
2359         wlc_radio_hwdisable_upd(wlc);
2360         wlc_radio_upd(wlc);
2361 }
2362
2363 static bool wlc_radio_monitor_start(wlc_info_t *wlc)
2364 {
2365         /* Don't start the timer if HWRADIO feature is disabled */
2366         if (wlc->radio_monitor || (wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO))
2367                 return true;
2368
2369         wlc->radio_monitor = true;
2370         wlc_pllreq(wlc, true, WLC_PLLREQ_RADIO_MON);
2371         wl_add_timer(wlc->wl, wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
2372         return true;
2373 }
2374
2375 bool wlc_radio_monitor_stop(wlc_info_t *wlc)
2376 {
2377         if (!wlc->radio_monitor)
2378                 return true;
2379
2380         ASSERT((wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO) !=
2381                WL_SWFL_NOHWRADIO);
2382
2383         wlc->radio_monitor = false;
2384         wlc_pllreq(wlc, false, WLC_PLLREQ_RADIO_MON);
2385         return wl_del_timer(wlc->wl, wlc->radio_timer);
2386 }
2387
2388 /* bring the driver down, but don't reset hardware */
2389 void wlc_out(wlc_info_t *wlc)
2390 {
2391         wlc_bmac_set_noreset(wlc->hw, true);
2392         wlc_radio_upd(wlc);
2393         wl_down(wlc->wl);
2394         wlc_bmac_set_noreset(wlc->hw, false);
2395
2396         /* core clk is true in BMAC driver due to noreset, need to mirror it in HIGH */
2397         wlc->clk = true;
2398
2399         /* This will make sure that when 'up' is done
2400          * after 'out' it'll restore hardware (especially gpios)
2401          */
2402         wlc->pub->hw_up = false;
2403 }
2404
2405 #if defined(BCMDBG)
2406 /* Verify the sanity of wlc->tx_prec_map. This can be done only by making sure that
2407  * if there is no packet pending for the FIFO, then the corresponding prec bits should be set
2408  * in prec_map. Of course, ignore this rule when block_datafifo is set
2409  */
2410 static bool wlc_tx_prec_map_verify(wlc_info_t *wlc)
2411 {
2412         /* For non-WME, both fifos have overlapping prec_map. So it's an error only if both
2413          * fail the check.
2414          */
2415         if (!EDCF_ENAB(wlc->pub)) {
2416                 if (!(WLC_TX_FIFO_CHECK(wlc, TX_DATA_FIFO) ||
2417                       WLC_TX_FIFO_CHECK(wlc, TX_CTL_FIFO)))
2418                         return false;
2419                 else
2420                         return true;
2421         }
2422
2423         return WLC_TX_FIFO_CHECK(wlc, TX_AC_BK_FIFO)
2424                 && WLC_TX_FIFO_CHECK(wlc, TX_AC_BE_FIFO)
2425                 && WLC_TX_FIFO_CHECK(wlc, TX_AC_VI_FIFO)
2426                 && WLC_TX_FIFO_CHECK(wlc, TX_AC_VO_FIFO);
2427 }
2428 #endif                          /* BCMDBG */
2429
2430 static void wlc_watchdog_by_timer(void *arg)
2431 {
2432         wlc_info_t *wlc = (wlc_info_t *) arg;
2433         wlc_watchdog(arg);
2434         if (WLC_WATCHDOG_TBTT(wlc)) {
2435                 /* set to normal osl watchdog period */
2436                 wl_del_timer(wlc->wl, wlc->wdtimer);
2437                 wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG,
2438                              true);
2439         }
2440 }
2441
2442 /* common watchdog code */
2443 static void wlc_watchdog(void *arg)
2444 {
2445         wlc_info_t *wlc = (wlc_info_t *) arg;
2446         int i;
2447         wlc_bsscfg_t *cfg;
2448
2449         WL_TRACE(("wl%d: wlc_watchdog\n", wlc->pub->unit));
2450
2451         if (!wlc->pub->up)
2452                 return;
2453
2454         if (DEVICEREMOVED(wlc)) {
2455                 WL_ERROR(("wl%d: %s: dead chip\n", wlc->pub->unit, __func__));
2456                 wl_down(wlc->wl);
2457                 return;
2458         }
2459
2460         /* increment second count */
2461         wlc->pub->now++;
2462
2463         /* delay radio disable */
2464         if (wlc->mpc_delay_off) {
2465                 if (--wlc->mpc_delay_off == 0) {
2466                         mboolset(wlc->pub->radio_disabled,
2467                                  WL_RADIO_MPC_DISABLE);
2468                         if (wlc->mpc && wlc_ismpc(wlc))
2469                                 wlc->mpc_offcnt = 0;
2470                         wlc->mpc_laston_ts = OSL_SYSUPTIME();
2471                 }
2472         }
2473
2474         /* mpc sync */
2475         wlc_radio_mpc_upd(wlc);
2476         /* radio sync: sw/hw/mpc --> radio_disable/radio_enable */
2477         wlc_radio_hwdisable_upd(wlc);
2478         wlc_radio_upd(wlc);
2479         /* if ismpc, driver should be in down state if up/down is allowed */
2480         if (wlc->mpc && wlc_ismpc(wlc))
2481                 ASSERT(!wlc->pub->up);
2482         /* if radio is disable, driver may be down, quit here */
2483         if (wlc->pub->radio_disabled)
2484                 return;
2485
2486         wlc_bmac_watchdog(wlc);
2487
2488         /* occasionally sample mac stat counters to detect 16-bit counter wrap */
2489         if ((WLC_UPDATE_STATS(wlc))
2490             && (!(wlc->pub->now % SW_TIMER_MAC_STAT_UPD)))
2491                 wlc_statsupd(wlc);
2492
2493         /* Manage TKIP countermeasures timers */
2494         FOREACH_BSS(wlc, i, cfg) {
2495                 if (cfg->tk_cm_dt) {
2496                         cfg->tk_cm_dt--;
2497                 }
2498                 if (cfg->tk_cm_bt) {
2499                         cfg->tk_cm_bt--;
2500                 }
2501         }
2502
2503         /* Call any registered watchdog handlers */
2504         for (i = 0; i < WLC_MAXMODULES; i++) {
2505                 if (wlc->modulecb[i].watchdog_fn)
2506                         wlc->modulecb[i].watchdog_fn(wlc->modulecb[i].hdl);
2507         }
2508
2509         if (WLCISNPHY(wlc->band) && !wlc->pub->tempsense_disable &&
2510             ((wlc->pub->now - wlc->tempsense_lasttime) >=
2511              WLC_TEMPSENSE_PERIOD)) {
2512                 wlc->tempsense_lasttime = wlc->pub->now;
2513                 wlc_tempsense_upd(wlc);
2514         }
2515         /* BMAC_NOTE: for HIGH_ONLY driver, this seems being called after RPC bus failed */
2516         ASSERT(wlc_bmac_taclear(wlc->hw, true));
2517
2518         /* Verify that tx_prec_map and fifos are in sync to avoid lock ups */
2519         ASSERT(wlc_tx_prec_map_verify(wlc));
2520
2521         ASSERT(wlc_ps_check(wlc));
2522 }
2523
2524 /* make interface operational */
2525 int wlc_up(wlc_info_t *wlc)
2526 {
2527         WL_TRACE(("wl%d: %s:\n", wlc->pub->unit, __func__));
2528
2529         /* HW is turned off so don't try to access it */
2530         if (wlc->pub->hw_off || DEVICEREMOVED(wlc))
2531                 return BCME_RADIOOFF;
2532
2533         if (!wlc->pub->hw_up) {
2534                 wlc_bmac_hw_up(wlc->hw);
2535                 wlc->pub->hw_up = true;
2536         }
2537
2538         if ((wlc->pub->boardflags & BFL_FEM)
2539             && (CHIPID(wlc->pub->sih->chip) == BCM4313_CHIP_ID)) {
2540                 if (wlc->pub->boardrev >= 0x1250
2541                     && (wlc->pub->boardflags & BFL_FEM_BT)) {
2542                         wlc_mhf(wlc, MHF5, MHF5_4313_GPIOCTRL,
2543                                 MHF5_4313_GPIOCTRL, WLC_BAND_ALL);
2544                 } else {
2545                         wlc_mhf(wlc, MHF4, MHF4_EXTPA_ENABLE, MHF4_EXTPA_ENABLE,
2546                                 WLC_BAND_ALL);
2547                 }
2548         }
2549
2550         /*
2551          * Need to read the hwradio status here to cover the case where the system
2552          * is loaded with the hw radio disabled. We do not want to bring the driver up in this case.
2553          * if radio is disabled, abort up, lower power, start radio timer and return 0(for NDIS)
2554          * don't call radio_update to avoid looping wlc_up.
2555          *
2556          * wlc_bmac_up_prep() returns either 0 or BCME_RADIOOFF only
2557          */
2558         if (!wlc->pub->radio_disabled) {
2559                 int status = wlc_bmac_up_prep(wlc->hw);
2560                 if (status == BCME_RADIOOFF) {
2561                         if (!mboolisset
2562                             (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
2563                                 int idx;
2564                                 wlc_bsscfg_t *bsscfg;
2565                                 mboolset(wlc->pub->radio_disabled,
2566                                          WL_RADIO_HW_DISABLE);
2567
2568                                 FOREACH_BSS(wlc, idx, bsscfg) {
2569                                         if (!BSSCFG_STA(bsscfg)
2570                                             || !bsscfg->enable || !bsscfg->BSS)
2571                                                 continue;
2572                                         WL_ERROR(("wl%d.%d: wlc_up: rfdisable -> " "wlc_bsscfg_disable()\n", wlc->pub->unit, idx));
2573                                 }
2574                         }
2575                 } else
2576                         ASSERT(!status);
2577         }
2578
2579         if (wlc->pub->radio_disabled) {
2580                 wlc_radio_monitor_start(wlc);
2581                 return 0;
2582         }
2583
2584         /* wlc_bmac_up_prep has done wlc_corereset(). so clk is on, set it */
2585         wlc->clk = true;
2586
2587         wlc_radio_monitor_stop(wlc);
2588
2589         /* Set EDCF hostflags */
2590         if (EDCF_ENAB(wlc->pub)) {
2591                 wlc_mhf(wlc, MHF1, MHF1_EDCF, MHF1_EDCF, WLC_BAND_ALL);
2592         } else {
2593                 wlc_mhf(wlc, MHF1, MHF1_EDCF, 0, WLC_BAND_ALL);
2594         }
2595
2596         if (WLC_WAR16165(wlc))
2597                 wlc_mhf(wlc, MHF2, MHF2_PCISLOWCLKWAR, MHF2_PCISLOWCLKWAR,
2598                         WLC_BAND_ALL);
2599
2600         wl_init(wlc->wl);
2601         wlc->pub->up = true;
2602
2603         if (wlc->bandinit_pending) {
2604                 wlc_suspend_mac_and_wait(wlc);
2605                 wlc_set_chanspec(wlc, wlc->default_bss->chanspec);
2606                 wlc->bandinit_pending = false;
2607                 wlc_enable_mac(wlc);
2608         }
2609
2610         wlc_bmac_up_finish(wlc->hw);
2611
2612         /* other software states up after ISR is running */
2613         /* start APs that were to be brought up but are not up  yet */
2614         /* if (AP_ENAB(wlc->pub)) wlc_restart_ap(wlc->ap); */
2615
2616         /* Program the TX wme params with the current settings */
2617         wlc_wme_retries_write(wlc);
2618
2619         /* start one second watchdog timer */
2620         ASSERT(!wlc->WDarmed);
2621         wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
2622         wlc->WDarmed = true;
2623
2624         /* ensure antenna config is up to date */
2625         wlc_stf_phy_txant_upd(wlc);
2626         /* ensure LDPC config is in sync */
2627         wlc_ht_update_ldpc(wlc, wlc->stf->ldpc);
2628
2629         return 0;
2630 }
2631
2632 /* Initialize the base precedence map for dequeueing from txq based on WME settings */
2633 static void wlc_tx_prec_map_init(wlc_info_t *wlc)
2634 {
2635         wlc->tx_prec_map = WLC_PREC_BMP_ALL;
2636         bzero(wlc->fifo2prec_map, sizeof(u16) * NFIFO);
2637
2638         /* For non-WME, both fifos have overlapping MAXPRIO. So just disable all precedences
2639          * if either is full.
2640          */
2641         if (!EDCF_ENAB(wlc->pub)) {
2642                 wlc->fifo2prec_map[TX_DATA_FIFO] = WLC_PREC_BMP_ALL;
2643                 wlc->fifo2prec_map[TX_CTL_FIFO] = WLC_PREC_BMP_ALL;
2644         } else {
2645                 wlc->fifo2prec_map[TX_AC_BK_FIFO] = WLC_PREC_BMP_AC_BK;
2646                 wlc->fifo2prec_map[TX_AC_BE_FIFO] = WLC_PREC_BMP_AC_BE;
2647                 wlc->fifo2prec_map[TX_AC_VI_FIFO] = WLC_PREC_BMP_AC_VI;
2648                 wlc->fifo2prec_map[TX_AC_VO_FIFO] = WLC_PREC_BMP_AC_VO;
2649         }
2650 }
2651
2652 static uint wlc_down_del_timer(wlc_info_t *wlc)
2653 {
2654         uint callbacks = 0;
2655
2656         return callbacks;
2657 }
2658
2659 /*
2660  * Mark the interface nonoperational, stop the software mechanisms,
2661  * disable the hardware, free any transient buffer state.
2662  * Return a count of the number of driver callbacks still pending.
2663  */
2664 uint wlc_down(wlc_info_t *wlc)
2665 {
2666
2667         uint callbacks = 0;
2668         int i;
2669         bool dev_gone = false;
2670         wlc_txq_info_t *qi;
2671
2672         WL_TRACE(("wl%d: %s:\n", wlc->pub->unit, __func__));
2673
2674         /* check if we are already in the going down path */
2675         if (wlc->going_down) {
2676                 WL_ERROR(("wl%d: %s: Driver going down so return\n",
2677                           wlc->pub->unit, __func__));
2678                 return 0;
2679         }
2680         if (!wlc->pub->up)
2681                 return callbacks;
2682
2683         /* in between, mpc could try to bring down again.. */
2684         wlc->going_down = true;
2685
2686         callbacks += wlc_bmac_down_prep(wlc->hw);
2687
2688         dev_gone = DEVICEREMOVED(wlc);
2689
2690         /* Call any registered down handlers */
2691         for (i = 0; i < WLC_MAXMODULES; i++) {
2692                 if (wlc->modulecb[i].down_fn)
2693                         callbacks +=
2694                             wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
2695         }
2696
2697         /* cancel the watchdog timer */
2698         if (wlc->WDarmed) {
2699                 if (!wl_del_timer(wlc->wl, wlc->wdtimer))
2700                         callbacks++;
2701                 wlc->WDarmed = false;
2702         }
2703         /* cancel all other timers */
2704         callbacks += wlc_down_del_timer(wlc);
2705
2706         /* interrupt must have been blocked */
2707         ASSERT((wlc->macintmask == 0) || !wlc->pub->up);
2708
2709         wlc->pub->up = false;
2710
2711         wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
2712
2713         /* clear txq flow control */
2714         wlc_txflowcontrol_reset(wlc);
2715
2716         /* flush tx queues */
2717         for (qi = wlc->tx_queues; qi != NULL; qi = qi->next) {
2718                 pktq_flush(wlc->osh, &qi->q, true, NULL, 0);
2719                 ASSERT(pktq_empty(&qi->q));
2720         }
2721
2722         /* flush event queue.
2723          * Should be the last thing done after all the events are generated
2724          * Just delivers the events synchronously instead of waiting for a timer
2725          */
2726         callbacks += wlc_eventq_down(wlc->eventq);
2727
2728         callbacks += wlc_bmac_down_finish(wlc->hw);
2729
2730         /* wlc_bmac_down_finish has done wlc_coredisable(). so clk is off */
2731         wlc->clk = false;
2732
2733
2734         /* Verify all packets are flushed from the driver */
2735         if (PKTALLOCED(wlc->osh) != 0) {
2736                 WL_ERROR(("%d packets not freed at wlc_down!!!!!!\n",
2737                           PKTALLOCED(wlc->osh)));
2738         }
2739 #ifdef BCMDBG
2740         /* Since all the packets should have been freed,
2741          * all callbacks should have been called
2742          */
2743         for (i = 1; i <= wlc->pub->tunables->maxpktcb; i++)
2744                 ASSERT(wlc->pkt_callback[i].fn == NULL);
2745 #endif
2746         wlc->going_down = false;
2747         return callbacks;
2748 }
2749
2750 /* Set the current gmode configuration */
2751 int wlc_set_gmode(wlc_info_t *wlc, u8 gmode, bool config)
2752 {
2753         int ret = 0;
2754         uint i;
2755         wlc_rateset_t rs;
2756         /* Default to 54g Auto */
2757         s8 shortslot = WLC_SHORTSLOT_AUTO;      /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
2758         bool shortslot_restrict = false;        /* Restrict association to stations that support shortslot
2759                                                  */
2760         bool ignore_bcns = true;        /* Ignore legacy beacons on the same channel */
2761         bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
2762         int preamble = WLC_PLCP_LONG;   /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
2763         bool preamble_restrict = false; /* Restrict association to stations that support short
2764                                          * preambles
2765                                          */
2766         wlcband_t *band;
2767
2768         /* if N-support is enabled, allow Gmode set as long as requested
2769          * Gmode is not GMODE_LEGACY_B
2770          */
2771         if (N_ENAB(wlc->pub) && gmode == GMODE_LEGACY_B)
2772                 return BCME_UNSUPPORTED;
2773
2774         /* verify that we are dealing with 2G band and grab the band pointer */
2775         if (wlc->band->bandtype == WLC_BAND_2G)
2776                 band = wlc->band;
2777         else if ((NBANDS(wlc) > 1) &&
2778                  (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == WLC_BAND_2G))
2779                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
2780         else
2781                 return BCME_BADBAND;
2782
2783         /* Legacy or bust when no OFDM is supported by regulatory */
2784         if ((wlc_channel_locale_flags_in_band(wlc->cmi, band->bandunit) &
2785              WLC_NO_OFDM) && (gmode != GMODE_LEGACY_B))
2786                 return BCME_RANGE;
2787
2788         /* update configuration value */
2789         if (config == true)
2790                 wlc_protection_upd(wlc, WLC_PROT_G_USER, gmode);
2791
2792         /* Clear supported rates filter */
2793         bzero(&wlc->sup_rates_override, sizeof(wlc_rateset_t));
2794
2795         /* Clear rateset override */
2796         bzero(&rs, sizeof(wlc_rateset_t));
2797
2798         switch (gmode) {
2799         case GMODE_LEGACY_B:
2800                 shortslot = WLC_SHORTSLOT_OFF;
2801                 wlc_rateset_copy(&gphy_legacy_rates, &rs);
2802
2803                 break;
2804
2805         case GMODE_LRS:
2806                 if (AP_ENAB(wlc->pub))
2807                         wlc_rateset_copy(&cck_rates, &wlc->sup_rates_override);
2808                 break;
2809
2810         case GMODE_AUTO:
2811                 /* Accept defaults */
2812                 break;
2813
2814         case GMODE_ONLY:
2815                 ofdm_basic = true;
2816                 preamble = WLC_PLCP_SHORT;
2817                 preamble_restrict = true;
2818                 break;
2819
2820         case GMODE_PERFORMANCE:
2821                 if (AP_ENAB(wlc->pub))  /* Put all rates into the Supported Rates element */
2822                         wlc_rateset_copy(&cck_ofdm_rates,
2823                                          &wlc->sup_rates_override);
2824
2825                 shortslot = WLC_SHORTSLOT_ON;
2826                 shortslot_restrict = true;
2827                 ofdm_basic = true;
2828                 preamble = WLC_PLCP_SHORT;
2829                 preamble_restrict = true;
2830                 break;
2831
2832         default:
2833                 /* Error */
2834                 WL_ERROR(("wl%d: %s: invalid gmode %d\n", wlc->pub->unit,
2835                           __func__, gmode));
2836                 return BCME_UNSUPPORTED;
2837         }
2838
2839         /*
2840          * If we are switching to gmode == GMODE_LEGACY_B,
2841          * clean up rate info that may refer to OFDM rates.
2842          */
2843         if ((gmode == GMODE_LEGACY_B) && (band->gmode != GMODE_LEGACY_B)) {
2844                 band->gmode = gmode;
2845                 if (band->rspec_override && !IS_CCK(band->rspec_override)) {
2846                         band->rspec_override = 0;
2847                         wlc_reprate_init(wlc);
2848                 }
2849                 if (band->mrspec_override && !IS_CCK(band->mrspec_override)) {
2850                         band->mrspec_override = 0;
2851                 }
2852         }
2853
2854         band->gmode = gmode;
2855
2856         wlc->ignore_bcns = ignore_bcns;
2857
2858         wlc->shortslot_override = shortslot;
2859
2860         if (AP_ENAB(wlc->pub)) {
2861                 /* wlc->ap->shortslot_restrict = shortslot_restrict; */
2862                 wlc->PLCPHdr_override =
2863                     (preamble !=
2864                      WLC_PLCP_LONG) ? WLC_PLCP_SHORT : WLC_PLCP_AUTO;
2865         }
2866
2867         if ((AP_ENAB(wlc->pub) && preamble != WLC_PLCP_LONG)
2868             || preamble == WLC_PLCP_SHORT)
2869                 wlc->default_bss->capability |= DOT11_CAP_SHORT;
2870         else
2871                 wlc->default_bss->capability &= ~DOT11_CAP_SHORT;
2872
2873         /* Update shortslot capability bit for AP and IBSS */
2874         if ((AP_ENAB(wlc->pub) && shortslot == WLC_SHORTSLOT_AUTO) ||
2875             shortslot == WLC_SHORTSLOT_ON)
2876                 wlc->default_bss->capability |= DOT11_CAP_SHORTSLOT;
2877         else
2878                 wlc->default_bss->capability &= ~DOT11_CAP_SHORTSLOT;
2879
2880         /* Use the default 11g rateset */
2881         if (!rs.count)
2882                 wlc_rateset_copy(&cck_ofdm_rates, &rs);
2883
2884         if (ofdm_basic) {
2885                 for (i = 0; i < rs.count; i++) {
2886                         if (rs.rates[i] == WLC_RATE_6M
2887                             || rs.rates[i] == WLC_RATE_12M
2888                             || rs.rates[i] == WLC_RATE_24M)
2889                                 rs.rates[i] |= WLC_RATE_FLAG;
2890                 }
2891         }
2892
2893         /* Set default bss rateset */
2894         wlc->default_bss->rateset.count = rs.count;
2895         bcopy((char *)rs.rates, (char *)wlc->default_bss->rateset.rates,
2896               sizeof(wlc->default_bss->rateset.rates));
2897
2898         return ret;
2899 }
2900
2901 static int wlc_nmode_validate(wlc_info_t *wlc, s32 nmode)
2902 {
2903         int err = 0;
2904
2905         switch (nmode) {
2906
2907         case OFF:
2908                 break;
2909
2910         case AUTO:
2911         case WL_11N_2x2:
2912         case WL_11N_3x3:
2913                 if (!(WLC_PHY_11N_CAP(wlc->band)))
2914                         err = BCME_BADBAND;
2915                 break;
2916
2917         default:
2918                 err = BCME_RANGE;
2919                 break;
2920         }
2921
2922         return err;
2923 }
2924
2925 int wlc_set_nmode(wlc_info_t *wlc, s32 nmode)
2926 {
2927         uint i;
2928         int err;
2929
2930         err = wlc_nmode_validate(wlc, nmode);
2931         ASSERT(err == 0);
2932         if (err)
2933                 return err;
2934
2935         switch (nmode) {
2936         case OFF:
2937                 wlc->pub->_n_enab = OFF;
2938                 wlc->default_bss->flags &= ~WLC_BSS_HT;
2939                 /* delete the mcs rates from the default and hw ratesets */
2940                 wlc_rateset_mcs_clear(&wlc->default_bss->rateset);
2941                 for (i = 0; i < NBANDS(wlc); i++) {
2942                         memset(wlc->bandstate[i]->hw_rateset.mcs, 0,
2943                                MCSSET_LEN);
2944                         if (IS_MCS(wlc->band->rspec_override)) {
2945                                 wlc->bandstate[i]->rspec_override = 0;
2946                                 wlc_reprate_init(wlc);
2947                         }
2948                         if (IS_MCS(wlc->band->mrspec_override))
2949                                 wlc->bandstate[i]->mrspec_override = 0;
2950                 }
2951                 break;
2952
2953         case AUTO:
2954                 if (wlc->stf->txstreams == WL_11N_3x3)
2955                         nmode = WL_11N_3x3;
2956                 else
2957                         nmode = WL_11N_2x2;
2958         case WL_11N_2x2:
2959         case WL_11N_3x3:
2960                 ASSERT(WLC_PHY_11N_CAP(wlc->band));
2961                 /* force GMODE_AUTO if NMODE is ON */
2962                 wlc_set_gmode(wlc, GMODE_AUTO, true);
2963                 if (nmode == WL_11N_3x3)
2964                         wlc->pub->_n_enab = SUPPORT_HT;
2965                 else
2966                         wlc->pub->_n_enab = SUPPORT_11N;
2967                 wlc->default_bss->flags |= WLC_BSS_HT;
2968                 /* add the mcs rates to the default and hw ratesets */
2969                 wlc_rateset_mcs_build(&wlc->default_bss->rateset,
2970                                       wlc->stf->txstreams);
2971                 for (i = 0; i < NBANDS(wlc); i++)
2972                         memcpy(wlc->bandstate[i]->hw_rateset.mcs,
2973                                wlc->default_bss->rateset.mcs, MCSSET_LEN);
2974                 break;
2975
2976         default:
2977                 ASSERT(0);
2978                 break;
2979         }
2980
2981         return err;
2982 }
2983
2984 static int wlc_set_rateset(wlc_info_t *wlc, wlc_rateset_t *rs_arg)
2985 {
2986         wlc_rateset_t rs, new;
2987         uint bandunit;
2988
2989         bcopy((char *)rs_arg, (char *)&rs, sizeof(wlc_rateset_t));
2990
2991         /* check for bad count value */
2992         if ((rs.count == 0) || (rs.count > WLC_NUMRATES))
2993                 return BCME_BADRATESET;
2994
2995         /* try the current band */
2996         bandunit = wlc->band->bandunit;
2997         bcopy((char *)&rs, (char *)&new, sizeof(wlc_rateset_t));
2998         if (wlc_rate_hwrs_filter_sort_validate
2999             (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
3000              wlc->stf->txstreams))
3001                 goto good;
3002
3003         /* try the other band */
3004         if (IS_MBAND_UNLOCKED(wlc)) {
3005                 bandunit = OTHERBANDUNIT(wlc);
3006                 bcopy((char *)&rs, (char *)&new, sizeof(wlc_rateset_t));
3007                 if (wlc_rate_hwrs_filter_sort_validate(&new,
3008                                                        &wlc->
3009                                                        bandstate[bandunit]->
3010                                                        hw_rateset, true,
3011                                                        wlc->stf->txstreams))
3012                         goto good;
3013         }
3014
3015         return BCME_ERROR;
3016
3017  good:
3018         /* apply new rateset */
3019         bcopy((char *)&new, (char *)&wlc->default_bss->rateset,
3020               sizeof(wlc_rateset_t));
3021         bcopy((char *)&new, (char *)&wlc->bandstate[bandunit]->defrateset,
3022               sizeof(wlc_rateset_t));
3023         return 0;
3024 }
3025
3026 /* simplified integer set interface for common ioctl handler */
3027 int wlc_set(wlc_info_t *wlc, int cmd, int arg)
3028 {
3029         return wlc_ioctl(wlc, cmd, (void *)&arg, sizeof(arg), NULL);
3030 }
3031
3032 /* simplified integer get interface for common ioctl handler */
3033 int wlc_get(wlc_info_t *wlc, int cmd, int *arg)
3034 {
3035         return wlc_ioctl(wlc, cmd, arg, sizeof(int), NULL);
3036 }
3037
3038 static void wlc_ofdm_rateset_war(wlc_info_t *wlc)
3039 {
3040         u8 r;
3041         bool war = false;
3042
3043         if (wlc->cfg->associated)
3044                 r = wlc->cfg->current_bss->rateset.rates[0];
3045         else
3046                 r = wlc->default_bss->rateset.rates[0];
3047
3048         wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
3049
3050         return;
3051 }
3052
3053 int
3054 wlc_ioctl(wlc_info_t *wlc, int cmd, void *arg, int len, struct wlc_if *wlcif)
3055 {
3056         return _wlc_ioctl(wlc, cmd, arg, len, wlcif);
3057 }
3058
3059 /* common ioctl handler. return: 0=ok, -1=error, positive=particular error */
3060 static int
3061 _wlc_ioctl(wlc_info_t *wlc, int cmd, void *arg, int len, struct wlc_if *wlcif)
3062 {
3063         int val, *pval;
3064         bool bool_val;
3065         int bcmerror;
3066         d11regs_t *regs;
3067         uint i;
3068         struct scb *nextscb;
3069         bool ta_ok;
3070         uint band;
3071         rw_reg_t *r;
3072         wlc_bsscfg_t *bsscfg;
3073         struct osl_info *osh;
3074         wlc_bss_info_t *current_bss;
3075
3076         /* update bsscfg pointer */
3077         bsscfg = NULL;          /* XXX: Hack bsscfg to be size one and use this globally */
3078         current_bss = NULL;
3079
3080         /* initialize the following to get rid of compiler warning */
3081         nextscb = NULL;
3082         ta_ok = false;
3083         band = 0;
3084         r = NULL;
3085
3086         /* If the device is turned off, then it's not "removed" */
3087         if (!wlc->pub->hw_off && DEVICEREMOVED(wlc)) {
3088                 WL_ERROR(("wl%d: %s: dead chip\n", wlc->pub->unit, __func__));
3089                 wl_down(wlc->wl);
3090                 return BCME_ERROR;
3091         }
3092
3093         ASSERT(!(wlc->pub->hw_off && wlc->pub->up));
3094
3095         /* default argument is generic integer */
3096         pval = arg ? (int *)arg:NULL;
3097
3098         /* This will prevent the misaligned access */
3099         if (pval && (u32) len >= sizeof(val))
3100                 bcopy(pval, &val, sizeof(val));
3101         else
3102                 val = 0;
3103
3104         /* bool conversion to avoid duplication below */
3105         bool_val = val != 0;
3106
3107         if (cmd != WLC_SET_CHANNEL)
3108                 WL_NONE(("WLC_IOCTL: cmd %d val 0x%x (%d) len %d\n", cmd,
3109                          (uint) val, val, len));
3110
3111         bcmerror = 0;
3112         regs = wlc->regs;
3113         osh = wlc->osh;
3114
3115         /* A few commands don't need any arguments; all the others do. */
3116         switch (cmd) {
3117         case WLC_UP:
3118         case WLC_OUT:
3119         case WLC_DOWN:
3120         case WLC_DISASSOC:
3121         case WLC_RESTART:
3122         case WLC_REBOOT:
3123         case WLC_START_CHANNEL_QA:
3124         case WLC_INIT:
3125                 break;
3126
3127         default:
3128                 if ((arg == NULL) || (len <= 0)) {
3129                         WL_ERROR(("wl%d: %s: Command %d needs arguments\n",
3130                                   wlc->pub->unit, __func__, cmd));
3131                         bcmerror = BCME_BADARG;
3132                         goto done;
3133                 }
3134         }
3135
3136         switch (cmd) {
3137
3138 #if defined(BCMDBG)
3139         case WLC_GET_MSGLEVEL:
3140                 *pval = wl_msg_level;
3141                 break;
3142
3143         case WLC_SET_MSGLEVEL:
3144                 wl_msg_level = val;
3145                 break;
3146 #endif
3147
3148         case WLC_GET_INSTANCE:
3149                 *pval = wlc->pub->unit;
3150                 break;
3151
3152         case WLC_GET_CHANNEL:{
3153                         channel_info_t *ci = (channel_info_t *) arg;
3154
3155                         ASSERT(len > (int)sizeof(ci));
3156
3157                         ci->hw_channel =
3158                             CHSPEC_CHANNEL(WLC_BAND_PI_RADIO_CHANSPEC);
3159                         ci->target_channel =
3160                             CHSPEC_CHANNEL(wlc->default_bss->chanspec);
3161                         ci->scan_channel = 0;
3162
3163                         break;
3164                 }
3165
3166         case WLC_SET_CHANNEL:{
3167                         chanspec_t chspec = CH20MHZ_CHSPEC(val);
3168
3169                         if (val < 0 || val > MAXCHANNEL) {
3170                                 bcmerror = BCME_OUTOFRANGECHAN;
3171                                 break;
3172                         }
3173
3174                         if (!wlc_valid_chanspec_db(wlc->cmi, chspec)) {
3175                                 bcmerror = BCME_BADCHAN;
3176                                 break;
3177                         }
3178
3179                         if (!wlc->pub->up && IS_MBAND_UNLOCKED(wlc)) {
3180                                 if (wlc->band->bandunit !=
3181                                     CHSPEC_WLCBANDUNIT(chspec))
3182                                         wlc->bandinit_pending = true;
3183                                 else
3184                                         wlc->bandinit_pending = false;
3185                         }
3186
3187                         wlc->default_bss->chanspec = chspec;
3188                         /* wlc_BSSinit() will sanitize the rateset before using it.. */
3189                         if (wlc->pub->up && !wlc->pub->associated &&
3190                             (WLC_BAND_PI_RADIO_CHANSPEC != chspec)) {
3191                                 wlc_set_home_chanspec(wlc, chspec);
3192                                 wlc_suspend_mac_and_wait(wlc);
3193                                 wlc_set_chanspec(wlc, chspec);
3194                                 wlc_enable_mac(wlc);
3195                         }
3196                         break;
3197                 }
3198
3199 #if defined(BCMDBG)
3200         case WLC_GET_UCFLAGS:
3201                 if (!wlc->pub->up) {
3202                         bcmerror = BCME_NOTUP;
3203                         break;
3204                 }
3205
3206                 /* optional band is stored in the second integer of incoming buffer */
3207                 band =
3208                     (len <
3209                      (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
3210
3211                 /* bcmerror checking */
3212                 bcmerror = wlc_iocregchk(wlc, band);
3213                 if (bcmerror)
3214                         break;
3215
3216                 if (val >= MHFMAX) {
3217                         bcmerror = BCME_RANGE;
3218                         break;
3219                 }
3220
3221                 *pval = wlc_bmac_mhf_get(wlc->hw, (u8) val, WLC_BAND_AUTO);
3222                 break;
3223
3224         case WLC_SET_UCFLAGS:
3225                 if (!wlc->pub->up) {
3226                         bcmerror = BCME_NOTUP;
3227                         break;
3228                 }
3229
3230                 /* optional band is stored in the second integer of incoming buffer */
3231                 band =
3232                     (len <
3233                      (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
3234
3235                 /* bcmerror checking */
3236                 bcmerror = wlc_iocregchk(wlc, band);
3237                 if (bcmerror)
3238                         break;
3239
3240                 i = (u16) val;
3241                 if (i >= MHFMAX) {
3242                         bcmerror = BCME_RANGE;
3243                         break;
3244                 }
3245
3246                 wlc_mhf(wlc, (u8) i, 0xffff, (u16) (val >> NBITS(u16)),
3247                         WLC_BAND_AUTO);
3248                 break;
3249
3250         case WLC_GET_SHMEM:
3251                 ta_ok = true;
3252
3253                 /* optional band is stored in the second integer of incoming buffer */
3254                 band =
3255                     (len <
3256                      (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
3257
3258                 /* bcmerror checking */
3259                 bcmerror = wlc_iocregchk(wlc, band);
3260                 if (bcmerror)
3261                         break;
3262
3263                 if (val & 1) {
3264                         bcmerror = BCME_BADADDR;
3265                         break;
3266                 }
3267
3268                 *pval = wlc_read_shm(wlc, (u16) val);
3269                 break;
3270
3271         case WLC_SET_SHMEM:
3272                 ta_ok = true;
3273
3274                 /* optional band is stored in the second integer of incoming buffer */
3275                 band =
3276                     (len <
3277                      (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
3278
3279                 /* bcmerror checking */
3280                 bcmerror = wlc_iocregchk(wlc, band);
3281                 if (bcmerror)
3282                         break;
3283
3284                 if (val & 1) {
3285                         bcmerror = BCME_BADADDR;
3286                         break;
3287                 }
3288
3289                 wlc_write_shm(wlc, (u16) val,
3290                               (u16) (val >> NBITS(u16)));
3291                 break;
3292
3293         case WLC_R_REG: /* MAC registers */
3294                 ta_ok = true;
3295                 r = (rw_reg_t *) arg;
3296                 band = WLC_BAND_AUTO;
3297
3298                 if (len < (int)(sizeof(rw_reg_t) - sizeof(uint))) {
3299                         bcmerror = BCME_BUFTOOSHORT;
3300                         break;
3301                 }
3302
3303                 if (len >= (int)sizeof(rw_reg_t))
3304                         band = r->band;
3305
3306                 /* bcmerror checking */
3307                 bcmerror = wlc_iocregchk(wlc, band);
3308                 if (bcmerror)
3309                         break;
3310
3311                 if ((r->byteoff + r->size) > sizeof(d11regs_t)) {
3312                         bcmerror = BCME_BADADDR;
3313                         break;
3314                 }
3315                 if (r->size == sizeof(u32))
3316                         r->val =
3317                             R_REG(osh,
3318                                   (u32 *)((unsigned char *)(unsigned long)regs +
3319                                               r->byteoff));
3320                 else if (r->size == sizeof(u16))
3321                         r->val =
3322                             R_REG(osh,
3323                                   (u16 *)((unsigned char *)(unsigned long)regs +
3324                                               r->byteoff));
3325                 else
3326                         bcmerror = BCME_BADADDR;
3327                 break;
3328
3329         case WLC_W_REG:
3330                 ta_ok = true;
3331                 r = (rw_reg_t *) arg;
3332                 band = WLC_BAND_AUTO;
3333
3334                 if (len < (int)(sizeof(rw_reg_t) - sizeof(uint))) {
3335                         bcmerror = BCME_BUFTOOSHORT;
3336                         break;
3337                 }
3338
3339                 if (len >= (int)sizeof(rw_reg_t))
3340                         band = r->band;
3341
3342                 /* bcmerror checking */
3343                 bcmerror = wlc_iocregchk(wlc, band);
3344                 if (bcmerror)
3345                         break;
3346
3347                 if (r->byteoff + r->size > sizeof(d11regs_t)) {
3348                         bcmerror = BCME_BADADDR;
3349                         break;
3350                 }
3351                 if (r->size == sizeof(u32))
3352                         W_REG(osh,
3353                               (u32 *)((unsigned char *)(unsigned long) regs +
3354                                           r->byteoff), r->val);
3355                 else if (r->size == sizeof(u16))
3356                         W_REG(osh,
3357                               (u16 *)((unsigned char *)(unsigned long) regs +
3358                                           r->byteoff), r->val);
3359                 else
3360                         bcmerror = BCME_BADADDR;
3361                 break;
3362 #endif                          /* BCMDBG */
3363
3364         case WLC_GET_TXANT:
3365                 *pval = wlc->stf->txant;
3366                 break;
3367
3368         case WLC_SET_TXANT:
3369                 bcmerror = wlc_stf_ant_txant_validate(wlc, (s8) val);
3370                 if (bcmerror < 0)
3371                         break;
3372
3373                 wlc->stf->txant = (s8) val;
3374
3375                 /* if down, we are done */
3376                 if (!wlc->pub->up)
3377                         break;
3378
3379                 wlc_suspend_mac_and_wait(wlc);
3380
3381                 wlc_stf_phy_txant_upd(wlc);
3382                 wlc_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
3383
3384                 wlc_enable_mac(wlc);
3385
3386                 break;
3387
3388         case WLC_GET_ANTDIV:{
3389                         u8 phy_antdiv;
3390
3391                         /* return configured value if core is down */
3392                         if (!wlc->pub->up) {
3393                                 *pval = wlc->stf->ant_rx_ovr;
3394
3395                         } else {
3396                                 if (wlc_phy_ant_rxdiv_get
3397                                     (wlc->band->pi, &phy_antdiv))
3398                                         *pval = (int)phy_antdiv;
3399                                 else
3400                                         *pval = (int)wlc->stf->ant_rx_ovr;
3401                         }
3402
3403                         break;
3404                 }
3405         case WLC_SET_ANTDIV:
3406                 /* values are -1=driver default, 0=force0, 1=force1, 2=start1, 3=start0 */
3407                 if ((val < -1) || (val > 3)) {
3408                         bcmerror = BCME_RANGE;
3409                         break;
3410                 }
3411
3412                 if (val == -1)
3413                         val = ANT_RX_DIV_DEF;
3414
3415                 wlc->stf->ant_rx_ovr = (u8) val;
3416                 wlc_phy_ant_rxdiv_set(wlc->band->pi, (u8) val);
3417                 break;
3418
3419         case WLC_GET_RX_ANT:{   /* get latest used rx antenna */
3420                         u16 rxstatus;
3421
3422                         if (!wlc->pub->up) {
3423                                 bcmerror = BCME_NOTUP;
3424                                 break;
3425                         }
3426
3427                         rxstatus = R_REG(wlc->osh, &wlc->regs->phyrxstatus0);
3428                         if (rxstatus == 0xdead || rxstatus == (u16) -1) {
3429                                 bcmerror = BCME_ERROR;
3430                                 break;
3431                         }
3432                         *pval = (rxstatus & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
3433                         break;
3434                 }
3435
3436 #if defined(BCMDBG)
3437         case WLC_GET_UCANTDIV:
3438                 if (!wlc->clk) {
3439                         bcmerror = BCME_NOCLK;
3440                         break;
3441                 }
3442
3443                 *pval =
3444                     (wlc_bmac_mhf_get(wlc->hw, MHF1, WLC_BAND_AUTO) &
3445                      MHF1_ANTDIV);
3446                 break;
3447
3448         case WLC_SET_UCANTDIV:{
3449                         if (!wlc->pub->up) {
3450                                 bcmerror = BCME_NOTUP;
3451                                 break;
3452                         }
3453
3454                         /* if multiband, band must be locked */
3455                         if (IS_MBAND_UNLOCKED(wlc)) {
3456                                 bcmerror = BCME_NOTBANDLOCKED;
3457                                 break;
3458                         }
3459
3460                         /* 4322 supports antdiv in phy, no need to set it to ucode */
3461                         if (WLCISNPHY(wlc->band)
3462                             && D11REV_IS(wlc->pub->corerev, 16)) {
3463                                 WL_ERROR(("wl%d: can't set ucantdiv for 4322\n",
3464                                           wlc->pub->unit));
3465                                 bcmerror = BCME_UNSUPPORTED;
3466                         } else
3467                                 wlc_mhf(wlc, MHF1, MHF1_ANTDIV,
3468                                         (val ? MHF1_ANTDIV : 0), WLC_BAND_AUTO);
3469                         break;
3470                 }
3471 #endif                          /* defined(BCMDBG) */
3472
3473         case WLC_GET_SRL:
3474                 *pval = wlc->SRL;
3475                 break;
3476
3477         case WLC_SET_SRL:
3478                 if (val >= 1 && val <= RETRY_SHORT_MAX) {
3479                         int ac;
3480                         wlc->SRL = (u16) val;
3481
3482                         wlc_bmac_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
3483
3484                         for (ac = 0; ac < AC_COUNT; ac++) {
3485                                 WLC_WME_RETRY_SHORT_SET(wlc, ac, wlc->SRL);
3486                         }
3487                         wlc_wme_retries_write(wlc);
3488                 } else
3489                         bcmerror = BCME_RANGE;
3490                 break;
3491
3492         case WLC_GET_LRL:
3493                 *pval = wlc->LRL;
3494                 break;
3495
3496         case WLC_SET_LRL:
3497                 if (val >= 1 && val <= 255) {
3498                         int ac;
3499                         wlc->LRL = (u16) val;
3500
3501                         wlc_bmac_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
3502
3503                         for (ac = 0; ac < AC_COUNT; ac++) {
3504                                 WLC_WME_RETRY_LONG_SET(wlc, ac, wlc->LRL);
3505                         }
3506                         wlc_wme_retries_write(wlc);
3507                 } else
3508                         bcmerror = BCME_RANGE;
3509                 break;
3510
3511         case WLC_GET_CWMIN:
3512                 *pval = wlc->band->CWmin;
3513                 break;
3514
3515         case WLC_SET_CWMIN:
3516                 if (!wlc->clk) {
3517                         bcmerror = BCME_NOCLK;
3518                         break;
3519                 }
3520
3521                 if (val >= 1 && val <= 255) {
3522                         wlc_set_cwmin(wlc, (u16) val);
3523                 } else
3524                         bcmerror = BCME_RANGE;
3525                 break;
3526
3527         case WLC_GET_CWMAX:
3528                 *pval = wlc->band->CWmax;
3529                 break;
3530
3531         case WLC_SET_CWMAX:
3532                 if (!wlc->clk) {
3533                         bcmerror = BCME_NOCLK;
3534                         break;
3535                 }
3536
3537                 if (val >= 255 && val <= 2047) {
3538                         wlc_set_cwmax(wlc, (u16) val);
3539                 } else
3540                         bcmerror = BCME_RANGE;
3541                 break;
3542
3543         case WLC_GET_RADIO:     /* use mask if don't want to expose some internal bits */
3544                 *pval = wlc->pub->radio_disabled;
3545                 break;
3546
3547         case WLC_SET_RADIO:{    /* 32 bits input, higher 16 bits are mask, lower 16 bits are value to
3548                                  * set
3549                                  */
3550                         u16 radiomask, radioval;
3551                         uint validbits =
3552                             WL_RADIO_SW_DISABLE | WL_RADIO_HW_DISABLE;
3553                         mbool new = 0;
3554
3555                         radiomask = (val & 0xffff0000) >> 16;
3556                         radioval = val & 0x0000ffff;
3557
3558                         if ((radiomask == 0) || (radiomask & ~validbits)
3559                             || (radioval & ~validbits)
3560                             || ((radioval & ~radiomask) != 0)) {
3561                                 WL_ERROR(("SET_RADIO with wrong bits 0x%x\n",
3562                                           val));
3563                                 bcmerror = BCME_RANGE;
3564                                 break;
3565                         }
3566
3567                         new =
3568                             (wlc->pub->radio_disabled & ~radiomask) | radioval;
3569                         wlc->pub->radio_disabled = new;
3570
3571                         wlc_radio_hwdisable_upd(wlc);
3572                         wlc_radio_upd(wlc);
3573                         break;
3574                 }
3575
3576         case WLC_GET_PHYTYPE:
3577                 *pval = WLC_PHYTYPE(wlc->band->phytype);
3578                 break;
3579
3580 #if defined(BCMDBG)
3581         case WLC_GET_KEY:
3582                 if ((val >= 0) && (val < WLC_MAX_WSEC_KEYS(wlc))) {
3583                         wl_wsec_key_t key;
3584
3585                         wsec_key_t *src_key = wlc->wsec_keys[val];
3586
3587                         if (len < (int)sizeof(key)) {
3588                                 bcmerror = BCME_BUFTOOSHORT;
3589                                 break;
3590                         }
3591
3592                         bzero((char *)&key, sizeof(key));
3593                         if (src_key) {
3594                                 key.index = src_key->id;
3595                                 key.len = src_key->len;
3596                                 bcopy(src_key->data, key.data, key.len);
3597                                 key.algo = src_key->algo;
3598                                 if (WSEC_SOFTKEY(wlc, src_key, bsscfg))
3599                                         key.flags |= WL_SOFT_KEY;
3600                                 if (src_key->flags & WSEC_PRIMARY_KEY)
3601                                         key.flags |= WL_PRIMARY_KEY;
3602
3603                                 bcopy(src_key->ea.octet, key.ea.octet,
3604                                       ETHER_ADDR_LEN);
3605                         }
3606
3607                         bcopy((char *)&key, arg, sizeof(key));
3608                 } else
3609                         bcmerror = BCME_BADKEYIDX;
3610                 break;
3611 #endif                          /* defined(BCMDBG) */
3612
3613         case WLC_SET_KEY:
3614                 bcmerror =
3615                     wlc_iovar_op(wlc, "wsec_key", NULL, 0, arg, len, IOV_SET,
3616                                  wlcif);
3617                 break;
3618
3619         case WLC_GET_KEY_SEQ:{
3620                         wsec_key_t *key;
3621
3622                         if (len < DOT11_WPA_KEY_RSC_LEN) {
3623                                 bcmerror = BCME_BUFTOOSHORT;
3624                                 break;
3625                         }
3626
3627                         /* Return the key's tx iv as an EAPOL sequence counter.
3628                          * This will be used to supply the RSC value to a supplicant.
3629                          * The format is 8 bytes, with least significant in seq[0].
3630                          */
3631
3632                         key = WSEC_KEY(wlc, val);
3633                         if ((val >= 0) && (val < WLC_MAX_WSEC_KEYS(wlc)) &&
3634                                 (key != NULL)) {
3635                                 u8 seq[DOT11_WPA_KEY_RSC_LEN];
3636                                 u16 lo;
3637                                 u32 hi;
3638                                 /* group keys in WPA-NONE (IBSS only, AES and TKIP) use a global TXIV */
3639                                 if ((bsscfg->WPA_auth & WPA_AUTH_NONE)
3640                                     && ETHER_ISNULLADDR(&key->ea)) {
3641                                         lo = bsscfg->wpa_none_txiv.lo;
3642                                         hi = bsscfg->wpa_none_txiv.hi;
3643                                 } else {
3644                                         lo = key->txiv.lo;
3645                                         hi = key->txiv.hi;
3646                                 }
3647
3648                                 /* format the buffer, low to high */
3649                                 seq[0] = lo & 0xff;
3650                                 seq[1] = (lo >> 8) & 0xff;
3651                                 seq[2] = hi & 0xff;
3652                                 seq[3] = (hi >> 8) & 0xff;
3653                                 seq[4] = (hi >> 16) & 0xff;
3654                                 seq[5] = (hi >> 24) & 0xff;
3655                                 seq[6] = 0;
3656                                 seq[7] = 0;
3657
3658                                 bcopy((char *)seq, arg, sizeof(seq));
3659                         } else {
3660                                 bcmerror = BCME_BADKEYIDX;
3661                         }
3662                         break;
3663                 }
3664
3665         case WLC_GET_CURR_RATESET:{
3666                         wl_rateset_t *ret_rs = (wl_rateset_t *) arg;
3667                         wlc_rateset_t *rs;
3668
3669                         if (bsscfg->associated)
3670                                 rs = &current_bss->rateset;
3671                         else
3672                                 rs = &wlc->default_bss->rateset;
3673
3674                         if (len < (int)(rs->count + sizeof(rs->count))) {
3675                                 bcmerror = BCME_BUFTOOSHORT;
3676                                 break;
3677                         }
3678
3679                         /* Copy only legacy rateset section */
3680                         ret_rs->count = rs->count;
3681                         bcopy(&rs->rates, &ret_rs->rates, rs->count);
3682                         break;
3683                 }
3684
3685         case WLC_GET_RATESET:{
3686                         wlc_rateset_t rs;
3687                         wl_rateset_t *ret_rs = (wl_rateset_t *) arg;
3688
3689                         bzero(&rs, sizeof(wlc_rateset_t));
3690                         wlc_default_rateset(wlc, (wlc_rateset_t *) &rs);
3691
3692                         if (len < (int)(rs.count + sizeof(rs.count))) {
3693                                 bcmerror = BCME_BUFTOOSHORT;
3694                                 break;
3695                         }
3696
3697                         /* Copy only legacy rateset section */
3698                         ret_rs->count = rs.count;
3699                         bcopy(&rs.rates, &ret_rs->rates, rs.count);
3700                         break;
3701                 }
3702
3703         case WLC_SET_RATESET:{
3704                         wlc_rateset_t rs;
3705                         wl_rateset_t *in_rs = (wl_rateset_t *) arg;
3706
3707                         if (len < (int)(in_rs->count + sizeof(in_rs->count))) {
3708                                 bcmerror = BCME_BUFTOOSHORT;
3709                                 break;
3710                         }
3711
3712                         if (in_rs->count > WLC_NUMRATES) {
3713                                 bcmerror = BCME_BUFTOOLONG;
3714                                 break;
3715                         }
3716
3717                         bzero(&rs, sizeof(wlc_rateset_t));
3718
3719                         /* Copy only legacy rateset section */
3720                         rs.count = in_rs->count;
3721                         bcopy(&in_rs->rates, &rs.rates, rs.count);
3722
3723                         /* merge rateset coming in with the current mcsset */
3724                         if (N_ENAB(wlc->pub)) {
3725                                 if (bsscfg->associated)
3726                                         bcopy(&current_bss->rateset.mcs[0],
3727                                               rs.mcs, MCSSET_LEN);
3728                                 else
3729                                         bcopy(&wlc->default_bss->rateset.mcs[0],
3730                                               rs.mcs, MCSSET_LEN);
3731                         }
3732
3733                         bcmerror = wlc_set_rateset(wlc, &rs);
3734
3735                         if (!bcmerror)
3736                                 wlc_ofdm_rateset_war(wlc);
3737
3738                         break;
3739                 }
3740
3741         case WLC_GET_BCNPRD:
3742                 if (BSSCFG_STA(bsscfg) && bsscfg->BSS && bsscfg->associated)
3743                         *pval = current_bss->beacon_period;
3744                 else
3745                         *pval = wlc->default_bss->beacon_period;
3746                 break;
3747
3748         case WLC_SET_BCNPRD:
3749                 /* range [1, 0xffff] */
3750                 if (val >= DOT11_MIN_BEACON_PERIOD
3751                     && val <= DOT11_MAX_BEACON_PERIOD) {
3752                         wlc->default_bss->beacon_period = (u16) val;
3753                 } else
3754                         bcmerror = BCME_RANGE;
3755                 break;
3756
3757         case WLC_GET_DTIMPRD:
3758                 if (BSSCFG_STA(bsscfg) && bsscfg->BSS && bsscfg->associated)
3759                         *pval = current_bss->dtim_period;
3760                 else
3761                         *pval = wlc->default_bss->dtim_period;
3762                 break;
3763
3764         case WLC_SET_DTIMPRD:
3765                 /* range [1, 0xff] */
3766                 if (val >= DOT11_MIN_DTIM_PERIOD
3767                     && val <= DOT11_MAX_DTIM_PERIOD) {
3768                         wlc->default_bss->dtim_period = (u8) val;
3769                 } else
3770                         bcmerror = BCME_RANGE;
3771                 break;
3772
3773 #ifdef SUPPORT_PS
3774         case WLC_GET_PM:
3775                 *pval = wlc->PM;
3776                 break;
3777
3778         case WLC_SET_PM:
3779                 if ((val >= PM_OFF) && (val <= PM_MAX)) {
3780                         wlc->PM = (u8) val;
3781                         if (wlc->pub->up) {
3782                         }
3783                         /* Change watchdog driver to align watchdog with tbtt if possible */
3784                         wlc_watchdog_upd(wlc, PS_ALLOWED(wlc));
3785                 } else
3786                         bcmerror = BCME_ERROR;
3787                 break;
3788 #endif                          /* SUPPORT_PS */
3789
3790 #ifdef SUPPORT_PS
3791 #ifdef BCMDBG
3792         case WLC_GET_WAKE:
3793                 if (AP_ENAB(wlc->pub)) {
3794                         bcmerror = BCME_NOTSTA;
3795                         break;
3796                 }
3797                 *pval = wlc->wake;
3798                 break;
3799
3800         case WLC_SET_WAKE:
3801                 if (AP_ENAB(wlc->pub)) {
3802                         bcmerror = BCME_NOTSTA;
3803                         break;
3804                 }
3805
3806                 wlc->wake = val ? true : false;
3807
3808                 /* if down, we're done */
3809                 if (!wlc->pub->up)
3810                         break;
3811
3812                 /* apply to the mac */
3813                 wlc_set_ps_ctrl(wlc);
3814                 break;
3815 #endif                          /* BCMDBG */
3816 #endif                          /* SUPPORT_PS */
3817
3818         case WLC_GET_REVINFO:
3819                 bcmerror = wlc_get_revision_info(wlc, arg, (uint) len);
3820                 break;
3821
3822         case WLC_GET_AP:
3823                 *pval = (int)AP_ENAB(wlc->pub);
3824                 break;
3825
3826         case WLC_GET_ATIM:
3827                 if (bsscfg->associated)
3828                         *pval = (int)current_bss->atim_window;
3829                 else
3830                         *pval = (int)wlc->default_bss->atim_window;
3831                 break;
3832
3833         case WLC_SET_ATIM:
3834                 wlc->default_bss->atim_window = (u32) val;
3835                 break;
3836
3837         case WLC_GET_PKTCNTS:{
3838                         get_pktcnt_t *pktcnt = (get_pktcnt_t *) pval;
3839                         if (WLC_UPDATE_STATS(wlc))
3840                                 wlc_statsupd(wlc);
3841                         pktcnt->rx_good_pkt = WLCNTVAL(wlc->pub->_cnt->rxframe);
3842                         pktcnt->rx_bad_pkt = WLCNTVAL(wlc->pub->_cnt->rxerror);
3843                         pktcnt->tx_good_pkt =
3844                             WLCNTVAL(wlc->pub->_cnt->txfrmsnt);
3845                         pktcnt->tx_bad_pkt =
3846                             WLCNTVAL(wlc->pub->_cnt->txerror) +
3847                             WLCNTVAL(wlc->pub->_cnt->txfail);
3848                         if (len >= (int)sizeof(get_pktcnt_t)) {
3849                                 /* Be backward compatible - only if buffer is large enough  */
3850                                 pktcnt->rx_ocast_good_pkt =
3851                                     WLCNTVAL(wlc->pub->_cnt->rxmfrmocast);
3852                         }
3853                         break;
3854                 }
3855
3856 #ifdef SUPPORT_HWKEY
3857         case WLC_GET_WSEC:
3858                 bcmerror =
3859                     wlc_iovar_op(wlc, "wsec", NULL, 0, arg, len, IOV_GET,
3860                                  wlcif);
3861                 break;
3862
3863         case WLC_SET_WSEC:
3864                 bcmerror =
3865                     wlc_iovar_op(wlc, "wsec", NULL, 0, arg, len, IOV_SET,
3866                                  wlcif);
3867                 break;
3868
3869         case WLC_GET_WPA_AUTH:
3870                 *pval = (int)bsscfg->WPA_auth;
3871                 break;
3872
3873         case WLC_SET_WPA_AUTH:
3874                 /* change of WPA_Auth modifies the PS_ALLOWED state */
3875                 if (BSSCFG_STA(bsscfg)) {
3876                         bsscfg->WPA_auth = (u16) val;
3877                 } else
3878                         bsscfg->WPA_auth = (u16) val;
3879                 break;
3880 #endif                          /* SUPPORT_HWKEY */
3881
3882         case WLC_GET_BANDLIST:
3883                 /* count of number of bands, followed by each band type */
3884                 *pval++ = NBANDS(wlc);
3885                 *pval++ = wlc->band->bandtype;
3886                 if (NBANDS(wlc) > 1)
3887                         *pval++ = wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype;
3888                 break;
3889
3890         case WLC_GET_BAND:
3891                 *pval = wlc->bandlocked ? wlc->band->bandtype : WLC_BAND_AUTO;
3892                 break;
3893
3894         case WLC_GET_PHYLIST:
3895                 {
3896                         unsigned char *cp = arg;
3897                         if (len < 3) {
3898                                 bcmerror = BCME_BUFTOOSHORT;
3899                                 break;
3900                         }
3901
3902                         if (WLCISNPHY(wlc->band)) {
3903                                 *cp++ = 'n';
3904                         } else if (WLCISLCNPHY(wlc->band)) {
3905                                 *cp++ = 'c';
3906                         } else if (WLCISSSLPNPHY(wlc->band)) {
3907                                 *cp++ = 's';
3908                         }
3909                         *cp = '\0';
3910                         break;
3911                 }
3912
3913         case WLC_GET_SHORTSLOT:
3914                 *pval = wlc->shortslot;
3915                 break;
3916
3917         case WLC_GET_SHORTSLOT_OVERRIDE:
3918                 *pval = wlc->shortslot_override;
3919                 break;
3920
3921         case WLC_SET_SHORTSLOT_OVERRIDE:
3922                 if ((val != WLC_SHORTSLOT_AUTO) &&
3923                     (val != WLC_SHORTSLOT_OFF) && (val != WLC_SHORTSLOT_ON)) {
3924                         bcmerror = BCME_RANGE;
3925                         break;
3926                 }
3927
3928                 wlc->shortslot_override = (s8) val;
3929
3930                 /* shortslot is an 11g feature, so no more work if we are
3931                  * currently on the 5G band
3932                  */
3933                 if (BAND_5G(wlc->band->bandtype))
3934                         break;
3935
3936                 if (wlc->pub->up && wlc->pub->associated) {
3937                         /* let watchdog or beacon processing update shortslot */
3938                 } else if (wlc->pub->up) {
3939                         /* unassociated shortslot is off */
3940                         wlc_switch_shortslot(wlc, false);
3941                 } else {
3942                         /* driver is down, so just update the wlc_info value */
3943                         if (wlc->shortslot_override == WLC_SHORTSLOT_AUTO) {
3944                                 wlc->shortslot = false;
3945                         } else {
3946                                 wlc->shortslot =
3947                                     (wlc->shortslot_override ==
3948                                      WLC_SHORTSLOT_ON);
3949                         }
3950                 }
3951
3952                 break;
3953
3954         case WLC_GET_LEGACY_ERP:
3955                 *pval = wlc->include_legacy_erp;
3956                 break;
3957
3958         case WLC_SET_LEGACY_ERP:
3959                 if (wlc->include_legacy_erp == bool_val)
3960                         break;
3961
3962                 wlc->include_legacy_erp = bool_val;
3963
3964                 if (AP_ENAB(wlc->pub) && wlc->clk) {
3965                         wlc_update_beacon(wlc);
3966                         wlc_update_probe_resp(wlc, true);
3967                 }
3968                 break;
3969
3970         case WLC_GET_GMODE:
3971                 if (wlc->band->bandtype == WLC_BAND_2G)
3972                         *pval = wlc->band->gmode;
3973                 else if (NBANDS(wlc) > 1)
3974                         *pval = wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode;
3975                 break;
3976
3977         case WLC_SET_GMODE:
3978                 if (!wlc->pub->associated)
3979                         bcmerror = wlc_set_gmode(wlc, (u8) val, true);
3980                 else {
3981                         bcmerror = BCME_ASSOCIATED;
3982                         break;
3983                 }
3984                 break;
3985
3986         case WLC_GET_GMODE_PROTECTION:
3987                 *pval = wlc->protection->_g;
3988                 break;
3989
3990         case WLC_GET_PROTECTION_CONTROL:
3991                 *pval = wlc->protection->overlap;
3992                 break;
3993
3994         case WLC_SET_PROTECTION_CONTROL:
3995                 if ((val != WLC_PROTECTION_CTL_OFF) &&
3996                     (val != WLC_PROTECTION_CTL_LOCAL) &&
3997                     (val != WLC_PROTECTION_CTL_OVERLAP)) {
3998                         bcmerror = BCME_RANGE;
3999                         break;
4000                 }
4001
4002                 wlc_protection_upd(wlc, WLC_PROT_OVERLAP, (s8) val);
4003
4004                 /* Current g_protection will sync up to the specified control alg in watchdog
4005                  * if the driver is up and associated.
4006                  * If the driver is down or not associated, the control setting has no effect.
4007                  */
4008                 break;
4009
4010         case WLC_GET_GMODE_PROTECTION_OVERRIDE:
4011                 *pval = wlc->protection->g_override;
4012                 break;
4013
4014         case WLC_SET_GMODE_PROTECTION_OVERRIDE:
4015                 if ((val != WLC_PROTECTION_AUTO) &&
4016                     (val != WLC_PROTECTION_OFF) && (val != WLC_PROTECTION_ON)) {
4017                         bcmerror = BCME_RANGE;
4018                         break;
4019                 }
4020
4021                 wlc_protection_upd(wlc, WLC_PROT_G_OVR, (s8) val);
4022
4023                 break;
4024
4025         case WLC_SET_SUP_RATESET_OVERRIDE:{
4026                         wlc_rateset_t rs, new;
4027
4028                         /* copyin */
4029                         if (len < (int)sizeof(wlc_rateset_t)) {
4030                                 bcmerror = BCME_BUFTOOSHORT;
4031                                 break;
4032                         }
4033                         bcopy((char *)arg, (char *)&rs, sizeof(wlc_rateset_t));
4034
4035                         /* check for bad count value */
4036                         if (rs.count > WLC_NUMRATES) {
4037                                 bcmerror = BCME_BADRATESET;     /* invalid rateset */
4038                                 break;
4039                         }
4040
4041                         /* this command is only appropriate for gmode operation */
4042                         if (!(wlc->band->gmode ||
4043                               ((NBANDS(wlc) > 1)
4044                                && wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode))) {
4045                                 bcmerror = BCME_BADBAND;        /* gmode only command when not in gmode */
4046                                 break;
4047                         }
4048
4049                         /* check for an empty rateset to clear the override */
4050                         if (rs.count == 0) {
4051                                 bzero(&wlc->sup_rates_override,
4052                                       sizeof(wlc_rateset_t));
4053                                 break;
4054                         }
4055
4056                         /* validate rateset by comparing pre and post sorted against 11g hw rates */
4057                         wlc_rateset_filter(&rs, &new, false, WLC_RATES_CCK_OFDM,
4058                                            RATE_MASK, BSS_N_ENAB(wlc, bsscfg));
4059                         wlc_rate_hwrs_filter_sort_validate(&new,
4060                                                            &cck_ofdm_rates,
4061                                                            false,
4062                                                            wlc->stf->txstreams);
4063                         if (rs.count != new.count) {
4064                                 bcmerror = BCME_BADRATESET;     /* invalid rateset */
4065                                 break;
4066                         }
4067
4068                         /* apply new rateset to the override */
4069                         bcopy((char *)&new, (char *)&wlc->sup_rates_override,
4070                               sizeof(wlc_rateset_t));
4071
4072                         /* update bcn and probe resp if needed */
4073                         if (wlc->pub->up && AP_ENAB(wlc->pub)
4074                             && wlc->pub->associated) {
4075                                 wlc_update_beacon(wlc);
4076                                 wlc_update_probe_resp(wlc, true);
4077                         }
4078                         break;
4079                 }
4080
4081         case WLC_GET_SUP_RATESET_OVERRIDE:
4082                 /* this command is only appropriate for gmode operation */
4083                 if (!(wlc->band->gmode ||
4084                       ((NBANDS(wlc) > 1)
4085                        && wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode))) {
4086                         bcmerror = BCME_BADBAND;        /* gmode only command when not in gmode */
4087                         break;
4088                 }
4089                 if (len < (int)sizeof(wlc_rateset_t)) {
4090                         bcmerror = BCME_BUFTOOSHORT;
4091                         break;
4092                 }
4093                 bcopy((char *)&wlc->sup_rates_override, (char *)arg,
4094                       sizeof(wlc_rateset_t));
4095
4096                 break;
4097
4098         case WLC_GET_PRB_RESP_TIMEOUT:
4099                 *pval = wlc->prb_resp_timeout;
4100                 break;
4101
4102         case WLC_SET_PRB_RESP_TIMEOUT:
4103                 if (wlc->pub->up) {
4104                         bcmerror = BCME_NOTDOWN;
4105                         break;
4106                 }
4107                 if (val < 0 || val >= 0xFFFF) {
4108                         bcmerror = BCME_RANGE;  /* bad value */
4109                         break;
4110                 }
4111                 wlc->prb_resp_timeout = (u16) val;
4112                 break;
4113
4114         case WLC_GET_KEY_PRIMARY:{
4115                         wsec_key_t *key;
4116
4117                         /* treat the 'val' parm as the key id */
4118                         key = WSEC_BSS_DEFAULT_KEY(bsscfg);
4119                         if (key != NULL) {
4120                                 *pval = key->id == val ? true : false;
4121                         } else {
4122                                 bcmerror = BCME_BADKEYIDX;
4123                         }
4124                         break;
4125                 }
4126
4127         case WLC_SET_KEY_PRIMARY:{
4128                         wsec_key_t *key, *old_key;
4129
4130                         bcmerror = BCME_BADKEYIDX;
4131
4132                         /* treat the 'val' parm as the key id */
4133                         for (i = 0; i < WSEC_MAX_DEFAULT_KEYS; i++) {
4134                                 key = bsscfg->bss_def_keys[i];
4135                                 if (key != NULL && key->id == val) {
4136                                         old_key = WSEC_BSS_DEFAULT_KEY(bsscfg);
4137                                         if (old_key != NULL)
4138                                                 old_key->flags &=
4139                                                     ~WSEC_PRIMARY_KEY;
4140                                         key->flags |= WSEC_PRIMARY_KEY;
4141                                         bsscfg->wsec_index = i;
4142                                         bcmerror = BCME_OK;
4143                                 }
4144                         }
4145                         break;
4146                 }
4147
4148 #ifdef BCMDBG
4149         case WLC_INIT:
4150                 wl_init(wlc->wl);
4151                 break;
4152 #endif
4153
4154         case WLC_SET_VAR:
4155         case WLC_GET_VAR:{
4156                         char *name;
4157                         /* validate the name value */
4158                         name = (char *)arg;
4159                         for (i = 0; i < (uint) len && *name != '\0';
4160                              i++, name++)
4161                                 ;
4162
4163                         if (i == (uint) len) {
4164                                 bcmerror = BCME_BUFTOOSHORT;
4165                                 break;
4166                         }
4167                         i++;    /* include the null in the string length */
4168
4169                         if (cmd == WLC_GET_VAR) {
4170                                 bcmerror =
4171                                     wlc_iovar_op(wlc, arg,
4172                                                  (void *)((s8 *) arg + i),
4173                                                  len - i, arg, len, IOV_GET,
4174                                                  wlcif);
4175                         } else
4176                                 bcmerror =
4177                                     wlc_iovar_op(wlc, arg, NULL, 0,
4178                                                  (void *)((s8 *) arg + i),
4179                                                  len - i, IOV_SET, wlcif);
4180
4181                         break;
4182                 }
4183
4184         case WLC_SET_WSEC_PMK:
4185                 bcmerror = BCME_UNSUPPORTED;
4186                 break;
4187
4188 #if defined(BCMDBG)
4189         case WLC_CURRENT_PWR:
4190                 if (!wlc->pub->up)
4191                         bcmerror = BCME_NOTUP;
4192                 else
4193                         bcmerror = wlc_get_current_txpwr(wlc, arg, len);
4194                 break;
4195 #endif
4196
4197         case WLC_LAST:
4198                 WL_ERROR(("%s: WLC_LAST\n", __func__));
4199         }
4200  done:
4201
4202         if (bcmerror) {
4203                 if (VALID_BCMERROR(bcmerror))
4204                         wlc->pub->bcmerror = bcmerror;
4205                 else {
4206                         bcmerror = 0;
4207                 }
4208
4209         }
4210         /* BMAC_NOTE: for HIGH_ONLY driver, this seems being called after RPC bus failed */
4211         /* In hw_off condition, IOCTLs that reach here are deemed safe but taclear would
4212          * certainly result in getting -1 for register reads. So skip ta_clear altogether
4213          */
4214         if (!(wlc->pub->hw_off))
4215                 ASSERT(wlc_bmac_taclear(wlc->hw, ta_ok) || !ta_ok);
4216
4217         return bcmerror;
4218 }
4219
4220 #if defined(BCMDBG)
4221 /* consolidated register access ioctl error checking */
4222 int wlc_iocregchk(wlc_info_t *wlc, uint band)
4223 {
4224         /* if band is specified, it must be the current band */
4225         if ((band != WLC_BAND_AUTO) && (band != (uint) wlc->band->bandtype))
4226                 return BCME_BADBAND;
4227
4228         /* if multiband and band is not specified, band must be locked */
4229         if ((band == WLC_BAND_AUTO) && IS_MBAND_UNLOCKED(wlc))
4230                 return BCME_NOTBANDLOCKED;
4231
4232         /* must have core clocks */
4233         if (!wlc->clk)
4234                 return BCME_NOCLK;
4235
4236         return 0;
4237 }
4238 #endif                          /* defined(BCMDBG) */
4239
4240 #if defined(BCMDBG)
4241 /* For some ioctls, make sure that the pi pointer matches the current phy */
4242 int wlc_iocpichk(wlc_info_t *wlc, uint phytype)
4243 {
4244         if (wlc->band->phytype != phytype)
4245                 return BCME_BADBAND;
4246         return 0;
4247 }
4248 #endif
4249
4250 /* Look up the given var name in the given table */
4251 static const bcm_iovar_t *wlc_iovar_lookup(const bcm_iovar_t *table,
4252                                            const char *name)
4253 {
4254         const bcm_iovar_t *vi;
4255         const char *lookup_name;
4256
4257         /* skip any ':' delimited option prefixes */
4258         lookup_name = strrchr(name, ':');
4259         if (lookup_name != NULL)
4260                 lookup_name++;
4261         else
4262                 lookup_name = name;
4263
4264         ASSERT(table != NULL);
4265
4266         for (vi = table; vi->name; vi++) {
4267                 if (!strcmp(vi->name, lookup_name))
4268                         return vi;
4269         }
4270         /* ran to end of table */
4271
4272         return NULL;            /* var name not found */
4273 }
4274
4275 /* simplified integer get interface for common WLC_GET_VAR ioctl handler */
4276 int wlc_iovar_getint(wlc_info_t *wlc, const char *name, int *arg)
4277 {
4278         return wlc_iovar_op(wlc, name, NULL, 0, arg, sizeof(s32), IOV_GET,
4279                             NULL);
4280 }
4281
4282 /* simplified integer set interface for common WLC_SET_VAR ioctl handler */
4283 int wlc_iovar_setint(wlc_info_t *wlc, const char *name, int arg)
4284 {
4285         return wlc_iovar_op(wlc, name, NULL, 0, (void *)&arg, sizeof(arg),
4286                             IOV_SET, NULL);
4287 }
4288
4289 /* simplified s8 get interface for common WLC_GET_VAR ioctl handler */
4290 int wlc_iovar_gets8(wlc_info_t *wlc, const char *name, s8 *arg)
4291 {
4292         int iovar_int;
4293         int err;
4294
4295         err =
4296             wlc_iovar_op(wlc, name, NULL, 0, &iovar_int, sizeof(iovar_int),
4297                          IOV_GET, NULL);
4298         if (!err)
4299                 *arg = (s8) iovar_int;
4300
4301         return err;
4302 }
4303
4304 /*
4305  * register iovar table, watchdog and down handlers.
4306  * calling function must keep 'iovars' until wlc_module_unregister is called.
4307  * 'iovar' must have the last entry's name field being NULL as terminator.
4308  */
4309 int wlc_module_register(wlc_pub_t *pub, const bcm_iovar_t *iovars,
4310                         const char *name, void *hdl, iovar_fn_t i_fn,
4311                         watchdog_fn_t w_fn, down_fn_t d_fn)
4312 {
4313         wlc_info_t *wlc = (wlc_info_t *) pub->wlc;
4314         int i;
4315
4316         ASSERT(name != NULL);
4317         ASSERT(i_fn != NULL || w_fn != NULL || d_fn != NULL);
4318
4319         /* find an empty entry and just add, no duplication check! */
4320         for (i = 0; i < WLC_MAXMODULES; i++) {
4321                 if (wlc->modulecb[i].name[0] == '\0') {
4322                         strncpy(wlc->modulecb[i].name, name,
4323                                 sizeof(wlc->modulecb[i].name) - 1);
4324                         wlc->modulecb[i].iovars = iovars;
4325                         wlc->modulecb[i].hdl = hdl;
4326                         wlc->modulecb[i].iovar_fn = i_fn;
4327                         wlc->modulecb[i].watchdog_fn = w_fn;
4328                         wlc->modulecb[i].down_fn = d_fn;
4329                         return 0;
4330                 }
4331         }
4332
4333         /* it is time to increase the capacity */
4334         ASSERT(i < WLC_MAXMODULES);
4335         return BCME_NORESOURCE;
4336 }
4337
4338 /* unregister module callbacks */
4339 int wlc_module_unregister(wlc_pub_t *pub, const char *name, void *hdl)
4340 {
4341         wlc_info_t *wlc = (wlc_info_t *) pub->wlc;
4342         int i;
4343
4344         if (wlc == NULL)
4345                 return BCME_NOTFOUND;
4346
4347         ASSERT(name != NULL);
4348
4349         for (i = 0; i < WLC_MAXMODULES; i++) {
4350                 if (!strcmp(wlc->modulecb[i].name, name) &&
4351                     (wlc->modulecb[i].hdl == hdl)) {
4352                         bzero(&wlc->modulecb[i], sizeof(modulecb_t));
4353                         return 0;
4354                 }
4355         }
4356
4357         /* table not found! */
4358         return BCME_NOTFOUND;
4359 }
4360
4361 /* Write WME tunable parameters for retransmit/max rate from wlc struct to ucode */
4362 static void wlc_wme_retries_write(wlc_info_t *wlc)
4363 {
4364         int ac;
4365
4366         /* Need clock to do this */
4367         if (!wlc->clk)
4368                 return;
4369
4370         for (ac = 0; ac < AC_COUNT; ac++) {
4371                 wlc_write_shm(wlc, M_AC_TXLMT_ADDR(ac), wlc->wme_retries[ac]);
4372         }
4373 }
4374
4375 /* Get or set an iovar.  The params/p_len pair specifies any additional
4376  * qualifying parameters (e.g. an "element index") for a get, while the
4377  * arg/len pair is the buffer for the value to be set or retrieved.
4378  * Operation (get/set) is specified by the last argument.
4379  * interface context provided by wlcif
4380  *
4381  * All pointers may point into the same buffer.
4382  */
4383 int
4384 wlc_iovar_op(wlc_info_t *wlc, const char *name,
4385              void *params, int p_len, void *arg, int len,
4386              bool set, struct wlc_if *wlcif)
4387 {
4388         int err = 0;
4389         int val_size;
4390         const bcm_iovar_t *vi = NULL;
4391         u32 actionid;
4392         int i;
4393
4394         ASSERT(name != NULL);
4395
4396         ASSERT(len >= 0);
4397
4398         /* Get MUST have return space */
4399         ASSERT(set || (arg && len));
4400
4401         ASSERT(!(wlc->pub->hw_off && wlc->pub->up));
4402
4403         /* Set does NOT take qualifiers */
4404         ASSERT(!set || (!params && !p_len));
4405
4406         if (!set && (len == sizeof(int)) &&
4407             !(IS_ALIGNED((unsigned long)(arg), (uint) sizeof(int)))) {
4408                 WL_ERROR(("wl%d: %s unaligned get ptr for %s\n",
4409                           wlc->pub->unit, __func__, name));
4410                 ASSERT(0);
4411         }
4412
4413         /* find the given iovar name */
4414         for (i = 0; i < WLC_MAXMODULES; i++) {
4415                 if (!wlc->modulecb[i].iovars)
4416                         continue;
4417                 vi = wlc_iovar_lookup(wlc->modulecb[i].iovars, name);
4418                 if (vi)
4419                         break;
4420         }
4421         /* iovar name not found */
4422         if (i >= WLC_MAXMODULES) {
4423                 err = BCME_UNSUPPORTED;
4424                 goto exit;
4425         }
4426
4427         /* set up 'params' pointer in case this is a set command so that
4428          * the convenience int and bool code can be common to set and get
4429          */
4430         if (params == NULL) {
4431                 params = arg;
4432                 p_len = len;
4433         }
4434
4435         if (vi->type == IOVT_VOID)
4436                 val_size = 0;
4437         else if (vi->type == IOVT_BUFFER)
4438                 val_size = len;
4439         else
4440                 /* all other types are integer sized */
4441                 val_size = sizeof(int);
4442
4443         actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
4444
4445         /* Do the actual parameter implementation */
4446         err = wlc->modulecb[i].iovar_fn(wlc->modulecb[i].hdl, vi, actionid,
4447                                         name, params, p_len, arg, len, val_size,
4448                                         wlcif);
4449
4450  exit:
4451         return err;
4452 }
4453
4454 int
4455 wlc_iovar_check(wlc_pub_t *pub, const bcm_iovar_t *vi, void *arg, int len,
4456                 bool set)
4457 {
4458         wlc_info_t *wlc = (wlc_info_t *) pub->wlc;
4459         int err = 0;
4460         s32 int_val = 0;
4461
4462         /* check generic condition flags */
4463         if (set) {
4464                 if (((vi->flags & IOVF_SET_DOWN) && wlc->pub->up) ||
4465                     ((vi->flags & IOVF_SET_UP) && !wlc->pub->up)) {
4466                         err = (wlc->pub->up ? BCME_NOTDOWN : BCME_NOTUP);
4467                 } else if ((vi->flags & IOVF_SET_BAND)
4468                            && IS_MBAND_UNLOCKED(wlc)) {
4469                         err = BCME_NOTBANDLOCKED;
4470                 } else if ((vi->flags & IOVF_SET_CLK) && !wlc->clk) {
4471                         err = BCME_NOCLK;
4472                 }
4473         } else {
4474                 if (((vi->flags & IOVF_GET_DOWN) && wlc->pub->up) ||
4475                     ((vi->flags & IOVF_GET_UP) && !wlc->pub->up)) {
4476                         err = (wlc->pub->up ? BCME_NOTDOWN : BCME_NOTUP);
4477                 } else if ((vi->flags & IOVF_GET_BAND)
4478                            && IS_MBAND_UNLOCKED(wlc)) {
4479                         err = BCME_NOTBANDLOCKED;
4480                 } else if ((vi->flags & IOVF_GET_CLK) && !wlc->clk) {
4481                         err = BCME_NOCLK;
4482                 }
4483         }
4484
4485         if (err)
4486                 goto exit;
4487
4488         /* length check on io buf */
4489         err = bcm_iovar_lencheck(vi, arg, len, set);
4490         if (err)
4491                 goto exit;
4492
4493         /* On set, check value ranges for integer types */
4494         if (set) {
4495                 switch (vi->type) {
4496                 case IOVT_BOOL:
4497                 case IOVT_INT8:
4498                 case IOVT_INT16:
4499                 case IOVT_INT32:
4500                 case IOVT_UINT8:
4501                 case IOVT_UINT16:
4502                 case IOVT_UINT32:
4503                         bcopy(arg, &int_val, sizeof(int));
4504                         err = wlc_iovar_rangecheck(wlc, int_val, vi);
4505                         break;
4506                 }
4507         }
4508  exit:
4509         return err;
4510 }
4511
4512 /* handler for iovar table wlc_iovars */
4513 /*
4514  * IMPLEMENTATION NOTE: In order to avoid checking for get/set in each
4515  * iovar case, the switch statement maps the iovar id into separate get
4516  * and set values.  If you add a new iovar to the switch you MUST use
4517  * IOV_GVAL and/or IOV_SVAL in the case labels to avoid conflict with
4518  * another case.
4519  * Please use params for additional qualifying parameters.
4520  */
4521 int
4522 wlc_doiovar(void *hdl, const bcm_iovar_t *vi, u32 actionid,
4523             const char *name, void *params, uint p_len, void *arg, int len,
4524             int val_size, struct wlc_if *wlcif)
4525 {
4526         wlc_info_t *wlc = hdl;
4527         wlc_bsscfg_t *bsscfg;
4528         int err = 0;
4529         s32 int_val = 0;
4530         s32 int_val2 = 0;
4531         s32 *ret_int_ptr;
4532         bool bool_val;
4533         bool bool_val2;
4534         wlc_bss_info_t *current_bss;
4535
4536         WL_TRACE(("wl%d: %s\n", wlc->pub->unit, __func__));
4537
4538         bsscfg = NULL;
4539         current_bss = NULL;
4540
4541         err = wlc_iovar_check(wlc->pub, vi, arg, len, IOV_ISSET(actionid));
4542         if (err != 0)
4543                 return err;
4544
4545         /* convenience int and bool vals for first 8 bytes of buffer */
4546         if (p_len >= (int)sizeof(int_val))
4547                 bcopy(params, &int_val, sizeof(int_val));
4548
4549         if (p_len >= (int)sizeof(int_val) * 2)
4550                 bcopy((void *)((unsigned long)params + sizeof(int_val)), &int_val2,
4551                       sizeof(int_val));
4552
4553         /* convenience int ptr for 4-byte gets (requires int aligned arg) */
4554         ret_int_ptr = (s32 *) arg;
4555
4556         bool_val = (int_val != 0) ? true : false;
4557         bool_val2 = (int_val2 != 0) ? true : false;
4558
4559         WL_TRACE(("wl%d: %s: id %d\n", wlc->pub->unit, __func__,
4560                   IOV_ID(actionid)));
4561         /* Do the actual parameter implementation */
4562         switch (actionid) {
4563
4564         case IOV_GVAL(IOV_QTXPOWER):{
4565                         uint qdbm;
4566                         bool override;
4567
4568                         err = wlc_phy_txpower_get(wlc->band->pi, &qdbm,
4569                                 &override);
4570                         if (err != BCME_OK)
4571                                 return err;
4572
4573                         /* Return qdbm units */
4574                         *ret_int_ptr =
4575                             qdbm | (override ? WL_TXPWR_OVERRIDE : 0);
4576                         break;
4577                 }
4578
4579                 /* As long as override is false, this only sets the *user* targets.
4580                    User can twiddle this all he wants with no harm.
4581                    wlc_phy_txpower_set() explicitly sets override to false if
4582                    not internal or test.
4583                  */
4584         case IOV_SVAL(IOV_QTXPOWER):{
4585                         u8 qdbm;
4586                         bool override;
4587
4588                         /* Remove override bit and clip to max qdbm value */
4589                         qdbm = (u8)min_t(u32, (int_val & ~WL_TXPWR_OVERRIDE), 0xff);
4590                         /* Extract override setting */
4591                         override = (int_val & WL_TXPWR_OVERRIDE) ? true : false;
4592                         err =
4593                             wlc_phy_txpower_set(wlc->band->pi, qdbm, override);
4594                         break;
4595                 }
4596
4597         case IOV_GVAL(IOV_MPC):
4598                 *ret_int_ptr = (s32) wlc->mpc;
4599                 break;
4600
4601         case IOV_SVAL(IOV_MPC):
4602                 wlc->mpc = bool_val;
4603                 wlc_radio_mpc_upd(wlc);
4604
4605                 break;
4606
4607         case IOV_GVAL(IOV_BCN_LI_BCN):
4608                 *ret_int_ptr = wlc->bcn_li_bcn;
4609                 break;
4610
4611         case IOV_SVAL(IOV_BCN_LI_BCN):
4612                 wlc->bcn_li_bcn = (u8) int_val;
4613                 if (wlc->pub->up)
4614                         wlc_bcn_li_upd(wlc);
4615                 break;
4616
4617         default:
4618                 WL_ERROR(("wl%d: %s: unsupported\n", wlc->pub->unit, __func__));
4619                 err = BCME_UNSUPPORTED;
4620                 break;
4621         }
4622
4623         goto exit;              /* avoid unused label warning */
4624
4625  exit:
4626         return err;
4627 }
4628
4629 static int
4630 wlc_iovar_rangecheck(wlc_info_t *wlc, u32 val, const bcm_iovar_t *vi)
4631 {
4632         int err = 0;
4633         u32 min_val = 0;
4634         u32 max_val = 0;
4635
4636         /* Only ranged integers are checked */
4637         switch (vi->type) {
4638         case IOVT_INT32:
4639                 max_val |= 0x7fffffff;
4640                 /* fall through */
4641         case IOVT_INT16:
4642                 max_val |= 0x00007fff;
4643                 /* fall through */
4644         case IOVT_INT8:
4645                 max_val |= 0x0000007f;
4646                 min_val = ~max_val;
4647                 if (vi->flags & IOVF_NTRL)
4648                         min_val = 1;
4649                 else if (vi->flags & IOVF_WHL)
4650                         min_val = 0;
4651                 /* Signed values are checked against max_val and min_val */
4652                 if ((s32) val < (s32) min_val
4653                     || (s32) val > (s32) max_val)
4654                         err = BCME_RANGE;
4655                 break;
4656
4657         case IOVT_UINT32:
4658                 max_val |= 0xffffffff;
4659                 /* fall through */
4660         case IOVT_UINT16:
4661                 max_val |= 0x0000ffff;
4662                 /* fall through */
4663         case IOVT_UINT8:
4664                 max_val |= 0x000000ff;
4665                 if (vi->flags & IOVF_NTRL)
4666                         min_val = 1;
4667                 if ((val < min_val) || (val > max_val))
4668                         err = BCME_RANGE;
4669                 break;
4670         }
4671
4672         return err;
4673 }
4674
4675 #ifdef BCMDBG
4676 static const char *supr_reason[] = {
4677         "None", "PMQ Entry", "Flush request",
4678         "Previous frag failure", "Channel mismatch",
4679         "Lifetime Expiry", "Underflow"
4680 };
4681
4682 static void wlc_print_txs_status(u16 s)
4683 {
4684         printf("[15:12]  %d  frame attempts\n", (s & TX_STATUS_FRM_RTX_MASK) >>
4685                TX_STATUS_FRM_RTX_SHIFT);
4686         printf(" [11:8]  %d  rts attempts\n", (s & TX_STATUS_RTS_RTX_MASK) >>
4687                TX_STATUS_RTS_RTX_SHIFT);
4688         printf("    [7]  %d  PM mode indicated\n",
4689                ((s & TX_STATUS_PMINDCTD) ? 1 : 0));
4690         printf("    [6]  %d  intermediate status\n",
4691                ((s & TX_STATUS_INTERMEDIATE) ? 1 : 0));
4692         printf("    [5]  %d  AMPDU\n", (s & TX_STATUS_AMPDU) ? 1 : 0);
4693         printf("  [4:2]  %d  Frame Suppressed Reason (%s)\n",
4694                ((s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT),
4695                supr_reason[(s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT]);
4696         printf("    [1]  %d  acked\n", ((s & TX_STATUS_ACK_RCV) ? 1 : 0));
4697 }
4698 #endif                          /* BCMDBG */
4699
4700 void wlc_print_txstatus(tx_status_t *txs)
4701 {
4702 #if defined(BCMDBG)
4703         u16 s = txs->status;
4704         u16 ackphyrxsh = txs->ackphyrxsh;
4705
4706         printf("\ntxpkt (MPDU) Complete\n");
4707
4708         printf("FrameID: %04x   ", txs->frameid);
4709         printf("TxStatus: %04x", s);
4710         printf("\n");
4711 #ifdef BCMDBG
4712         wlc_print_txs_status(s);
4713 #endif
4714         printf("LastTxTime: %04x ", txs->lasttxtime);
4715         printf("Seq: %04x ", txs->sequence);
4716         printf("PHYTxStatus: %04x ", txs->phyerr);
4717         printf("RxAckRSSI: %04x ",
4718                (ackphyrxsh & PRXS1_JSSI_MASK) >> PRXS1_JSSI_SHIFT);
4719         printf("RxAckSQ: %04x", (ackphyrxsh & PRXS1_SQ_MASK) >> PRXS1_SQ_SHIFT);
4720         printf("\n");
4721 #endif                          /* defined(BCMDBG) */
4722 }
4723
4724 #define MACSTATUPD(name) \
4725         wlc_ctrupd_cache(macstats.name, &wlc->core->macstat_snapshot->name, &wlc->pub->_cnt->name)
4726
4727 void wlc_statsupd(wlc_info_t *wlc)
4728 {
4729         int i;
4730 #ifdef BCMDBG
4731         u16 delta;
4732         u16 rxf0ovfl;
4733         u16 txfunfl[NFIFO];
4734 #endif                          /* BCMDBG */
4735
4736         /* if driver down, make no sense to update stats */
4737         if (!wlc->pub->up)
4738                 return;
4739
4740 #ifdef BCMDBG
4741         /* save last rx fifo 0 overflow count */
4742         rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
4743
4744         /* save last tx fifo  underflow count */
4745         for (i = 0; i < NFIFO; i++)
4746                 txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
4747 #endif                          /* BCMDBG */
4748
4749 #ifdef BCMDBG
4750         /* check for rx fifo 0 overflow */
4751         delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
4752         if (delta)
4753                 WL_ERROR(("wl%d: %u rx fifo 0 overflows!\n", wlc->pub->unit,
4754                           delta));
4755
4756         /* check for tx fifo underflows */
4757         for (i = 0; i < NFIFO; i++) {
4758                 delta =
4759                     (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
4760                               txfunfl[i]);
4761                 if (delta)
4762                         WL_ERROR(("wl%d: %u tx fifo %d underflows!\n",
4763                                   wlc->pub->unit, delta, i));
4764         }
4765 #endif                          /* BCMDBG */
4766
4767         /* dot11 counter update */
4768
4769         WLCNTSET(wlc->pub->_cnt->txrts,
4770                  (wlc->pub->_cnt->rxctsucast -
4771                   wlc->pub->_cnt->d11cnt_txrts_off));
4772         WLCNTSET(wlc->pub->_cnt->rxcrc,
4773                  (wlc->pub->_cnt->rxbadfcs - wlc->pub->_cnt->d11cnt_rxcrc_off));
4774         WLCNTSET(wlc->pub->_cnt->txnocts,
4775                  ((wlc->pub->_cnt->txrtsfrm - wlc->pub->_cnt->rxctsucast) -
4776                   wlc->pub->_cnt->d11cnt_txnocts_off));
4777
4778         /* merge counters from dma module */
4779         for (i = 0; i < NFIFO; i++) {
4780                 if (wlc->hw->di[i]) {
4781                         WLCNTADD(wlc->pub->_cnt->txnobuf,
4782                                  (wlc->hw->di[i])->txnobuf);
4783                         WLCNTADD(wlc->pub->_cnt->rxnobuf,
4784                                  (wlc->hw->di[i])->rxnobuf);
4785                         WLCNTADD(wlc->pub->_cnt->rxgiant,
4786                                  (wlc->hw->di[i])->rxgiants);
4787                         dma_counterreset(wlc->hw->di[i]);
4788                 }
4789         }
4790
4791         /*
4792          * Aggregate transmit and receive errors that probably resulted
4793          * in the loss of a frame are computed on the fly.
4794          */
4795         WLCNTSET(wlc->pub->_cnt->txerror,
4796                  wlc->pub->_cnt->txnobuf + wlc->pub->_cnt->txnoassoc +
4797                  wlc->pub->_cnt->txuflo + wlc->pub->_cnt->txrunt +
4798                  wlc->pub->_cnt->dmade + wlc->pub->_cnt->dmada +
4799                  wlc->pub->_cnt->dmape);
4800         WLCNTSET(wlc->pub->_cnt->rxerror,
4801                  wlc->pub->_cnt->rxoflo + wlc->pub->_cnt->rxnobuf +
4802                  wlc->pub->_cnt->rxfragerr + wlc->pub->_cnt->rxrunt +
4803                  wlc->pub->_cnt->rxgiant + wlc->pub->_cnt->rxnoscb +
4804                  wlc->pub->_cnt->rxbadsrcmac);
4805         for (i = 0; i < NFIFO; i++)
4806                 WLCNTADD(wlc->pub->_cnt->rxerror, wlc->pub->_cnt->rxuflo[i]);
4807 }
4808
4809 bool wlc_chipmatch(u16 vendor, u16 device)
4810 {
4811         if (vendor != VENDOR_BROADCOM) {
4812                 WL_ERROR(("wlc_chipmatch: unknown vendor id %04x\n", vendor));
4813                 return false;
4814         }
4815
4816         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
4817                 return true;
4818
4819         if (device == BCM4313_D11N2G_ID)
4820                 return true;
4821         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
4822                 return true;
4823
4824         WL_ERROR(("wlc_chipmatch: unknown device id %04x\n", device));
4825         return false;
4826 }
4827
4828 #if defined(BCMDBG)
4829 void wlc_print_txdesc(d11txh_t *txh)
4830 {
4831         u16 mtcl = ltoh16(txh->MacTxControlLow);
4832         u16 mtch = ltoh16(txh->MacTxControlHigh);
4833         u16 mfc = ltoh16(txh->MacFrameControl);
4834         u16 tfest = ltoh16(txh->TxFesTimeNormal);
4835         u16 ptcw = ltoh16(txh->PhyTxControlWord);
4836         u16 ptcw_1 = ltoh16(txh->PhyTxControlWord_1);
4837         u16 ptcw_1_Fbr = ltoh16(txh->PhyTxControlWord_1_Fbr);
4838         u16 ptcw_1_Rts = ltoh16(txh->PhyTxControlWord_1_Rts);
4839         u16 ptcw_1_FbrRts = ltoh16(txh->PhyTxControlWord_1_FbrRts);
4840         u16 mainrates = ltoh16(txh->MainRates);
4841         u16 xtraft = ltoh16(txh->XtraFrameTypes);
4842         u8 *iv = txh->IV;
4843         u8 *ra = txh->TxFrameRA;
4844         u16 tfestfb = ltoh16(txh->TxFesTimeFallback);
4845         u8 *rtspfb = txh->RTSPLCPFallback;
4846         u16 rtsdfb = ltoh16(txh->RTSDurFallback);
4847         u8 *fragpfb = txh->FragPLCPFallback;
4848         u16 fragdfb = ltoh16(txh->FragDurFallback);
4849         u16 mmodelen = ltoh16(txh->MModeLen);
4850         u16 mmodefbrlen = ltoh16(txh->MModeFbrLen);
4851         u16 tfid = ltoh16(txh->TxFrameID);
4852         u16 txs = ltoh16(txh->TxStatus);
4853         u16 mnmpdu = ltoh16(txh->MaxNMpdus);
4854         u16 mabyte = ltoh16(txh->MaxABytes_MRT);
4855         u16 mabyte_f = ltoh16(txh->MaxABytes_FBR);
4856         u16 mmbyte = ltoh16(txh->MinMBytes);
4857
4858         u8 *rtsph = txh->RTSPhyHeader;
4859         struct dot11_rts_frame rts = txh->rts_frame;
4860         char hexbuf[256];
4861
4862         /* add plcp header along with txh descriptor */
4863         prhex("Raw TxDesc + plcp header", (unsigned char *) txh, sizeof(d11txh_t) + 48);
4864
4865         printf("TxCtlLow: %04x ", mtcl);
4866         printf("TxCtlHigh: %04x ", mtch);
4867         printf("FC: %04x ", mfc);
4868         printf("FES Time: %04x\n", tfest);
4869         printf("PhyCtl: %04x%s ", ptcw,
4870                (ptcw & PHY_TXC_SHORT_HDR) ? " short" : "");
4871         printf("PhyCtl_1: %04x ", ptcw_1);
4872         printf("PhyCtl_1_Fbr: %04x\n", ptcw_1_Fbr);
4873         printf("PhyCtl_1_Rts: %04x ", ptcw_1_Rts);
4874         printf("PhyCtl_1_Fbr_Rts: %04x\n", ptcw_1_FbrRts);
4875         printf("MainRates: %04x ", mainrates);
4876         printf("XtraFrameTypes: %04x ", xtraft);
4877         printf("\n");
4878
4879         bcm_format_hex(hexbuf, iv, sizeof(txh->IV));
4880         printf("SecIV:       %s\n", hexbuf);
4881         bcm_format_hex(hexbuf, ra, sizeof(txh->TxFrameRA));
4882         printf("RA:          %s\n", hexbuf);
4883
4884         printf("Fb FES Time: %04x ", tfestfb);
4885         bcm_format_hex(hexbuf, rtspfb, sizeof(txh->RTSPLCPFallback));
4886         printf("RTS PLCP: %s ", hexbuf);
4887         printf("RTS DUR: %04x ", rtsdfb);
4888         bcm_format_hex(hexbuf, fragpfb, sizeof(txh->FragPLCPFallback));
4889         printf("PLCP: %s ", hexbuf);
4890         printf("DUR: %04x", fragdfb);
4891         printf("\n");
4892
4893         printf("MModeLen: %04x ", mmodelen);
4894         printf("MModeFbrLen: %04x\n", mmodefbrlen);
4895
4896         printf("FrameID:     %04x\n", tfid);
4897         printf("TxStatus:    %04x\n", txs);
4898
4899         printf("MaxNumMpdu:  %04x\n", mnmpdu);
4900         printf("MaxAggbyte:  %04x\n", mabyte);
4901         printf("MaxAggbyte_fb:  %04x\n", mabyte_f);
4902         printf("MinByte:     %04x\n", mmbyte);
4903
4904         bcm_format_hex(hexbuf, rtsph, sizeof(txh->RTSPhyHeader));
4905         printf("RTS PLCP: %s ", hexbuf);
4906         bcm_format_hex(hexbuf, (u8 *) &rts, sizeof(txh->rts_frame));
4907         printf("RTS Frame: %s", hexbuf);
4908         printf("\n");
4909
4910 }
4911 #endif                          /* defined(BCMDBG) */
4912
4913 #if defined(BCMDBG)
4914 void wlc_print_rxh(d11rxhdr_t *rxh)
4915 {
4916         u16 len = rxh->RxFrameSize;
4917         u16 phystatus_0 = rxh->PhyRxStatus_0;
4918         u16 phystatus_1 = rxh->PhyRxStatus_1;
4919         u16 phystatus_2 = rxh->PhyRxStatus_2;
4920         u16 phystatus_3 = rxh->PhyRxStatus_3;
4921         u16 macstatus1 = rxh->RxStatus1;
4922         u16 macstatus2 = rxh->RxStatus2;
4923         char flagstr[64];
4924         char lenbuf[20];
4925         static const bcm_bit_desc_t macstat_flags[] = {
4926                 {RXS_FCSERR, "FCSErr"},
4927                 {RXS_RESPFRAMETX, "Reply"},
4928                 {RXS_PBPRES, "PADDING"},
4929                 {RXS_DECATMPT, "DeCr"},
4930                 {RXS_DECERR, "DeCrErr"},
4931                 {RXS_BCNSENT, "Bcn"},
4932                 {0, NULL}
4933         };
4934
4935         prhex("Raw RxDesc", (unsigned char *) rxh, sizeof(d11rxhdr_t));
4936
4937         bcm_format_flags(macstat_flags, macstatus1, flagstr, 64);
4938
4939         snprintf(lenbuf, sizeof(lenbuf), "0x%x", len);
4940
4941         printf("RxFrameSize:     %6s (%d)%s\n", lenbuf, len,
4942                (rxh->PhyRxStatus_0 & PRXS0_SHORTH) ? " short preamble" : "");
4943         printf("RxPHYStatus:     %04x %04x %04x %04x\n",
4944                phystatus_0, phystatus_1, phystatus_2, phystatus_3);
4945         printf("RxMACStatus:     %x %s\n", macstatus1, flagstr);
4946         printf("RXMACaggtype: %x\n", (macstatus2 & RXS_AGGTYPE_MASK));
4947         printf("RxTSFTime:       %04x\n", rxh->RxTSFTime);
4948 }
4949 #endif                          /* defined(BCMDBG) */
4950
4951 #if defined(BCMDBG)
4952 int wlc_format_ssid(char *buf, const unsigned char ssid[], uint ssid_len)
4953 {
4954         uint i, c;
4955         char *p = buf;
4956         char *endp = buf + SSID_FMT_BUF_LEN;
4957
4958         if (ssid_len > DOT11_MAX_SSID_LEN)
4959                 ssid_len = DOT11_MAX_SSID_LEN;
4960
4961         for (i = 0; i < ssid_len; i++) {
4962                 c = (uint) ssid[i];
4963                 if (c == '\\') {
4964                         *p++ = '\\';
4965                         *p++ = '\\';
4966                 } else if (isprint((unsigned char) c)) {
4967                         *p++ = (char)c;
4968                 } else {
4969                         p += snprintf(p, (endp - p), "\\x%02X", c);
4970                 }
4971         }
4972         *p = '\0';
4973         ASSERT(p < endp);
4974
4975         return (int)(p - buf);
4976 }
4977 #endif                          /* defined(BCMDBG) */
4978
4979 u16 wlc_rate_shm_offset(wlc_info_t *wlc, u8 rate)
4980 {
4981         return wlc_bmac_rate_shm_offset(wlc->hw, rate);
4982 }
4983
4984 /* Callback for device removed */
4985
4986 /*
4987  * Attempts to queue a packet onto a multiple-precedence queue,
4988  * if necessary evicting a lower precedence packet from the queue.
4989  *
4990  * 'prec' is the precedence number that has already been mapped
4991  * from the packet priority.
4992  *
4993  * Returns true if packet consumed (queued), false if not.
4994  */
4995 bool BCMFASTPATH
4996 wlc_prec_enq(wlc_info_t *wlc, struct pktq *q, void *pkt, int prec)
4997 {
4998         return wlc_prec_enq_head(wlc, q, pkt, prec, false);
4999 }
5000
5001 bool BCMFASTPATH
5002 wlc_prec_enq_head(wlc_info_t *wlc, struct pktq *q, struct sk_buff *pkt,
5003                   int prec, bool head)
5004 {
5005         struct sk_buff *p;
5006         int eprec = -1;         /* precedence to evict from */
5007
5008         /* Determine precedence from which to evict packet, if any */
5009         if (pktq_pfull(q, prec))
5010                 eprec = prec;
5011         else if (pktq_full(q)) {
5012                 p = pktq_peek_tail(q, &eprec);
5013                 ASSERT(p != NULL);
5014                 if (eprec > prec) {
5015                         WL_ERROR(("%s: Failing: eprec %d > prec %d\n", __func__,
5016                                   eprec, prec));
5017                         return false;
5018                 }
5019         }
5020
5021         /* Evict if needed */
5022         if (eprec >= 0) {
5023                 bool discard_oldest;
5024
5025                 /* Detect queueing to unconfigured precedence */
5026                 ASSERT(!pktq_pempty(q, eprec));
5027
5028                 discard_oldest = AC_BITMAP_TST(wlc->wme_dp, eprec);
5029
5030                 /* Refuse newer packet unless configured to discard oldest */
5031                 if (eprec == prec && !discard_oldest) {
5032                         WL_ERROR(("%s: No where to go, prec == %d\n", __func__,
5033                                   prec));
5034                         return false;
5035                 }
5036
5037                 /* Evict packet according to discard policy */
5038                 p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q,
5039                                                                           eprec);
5040                 ASSERT(p != NULL);
5041
5042                 /* Increment wme stats */
5043                 if (WME_ENAB(wlc->pub)) {
5044                         WLCNTINCR(wlc->pub->_wme_cnt->
5045                                   tx_failed[WME_PRIO2AC(p->priority)].packets);
5046                         WLCNTADD(wlc->pub->_wme_cnt->
5047                                  tx_failed[WME_PRIO2AC(p->priority)].bytes,
5048                                  pkttotlen(wlc->osh, p));
5049                 }
5050
5051                 ASSERT(0);
5052                 PKTFREE(wlc->osh, p, true);
5053                 WLCNTINCR(wlc->pub->_cnt->txnobuf);
5054         }
5055
5056         /* Enqueue */
5057         if (head)
5058                 p = pktq_penq_head(q, prec, pkt);
5059         else
5060                 p = pktq_penq(q, prec, pkt);
5061         ASSERT(p != NULL);
5062
5063         return true;
5064 }
5065
5066 void BCMFASTPATH wlc_txq_enq(void *ctx, struct scb *scb, struct sk_buff *sdu,
5067                              uint prec)
5068 {
5069         wlc_info_t *wlc = (wlc_info_t *) ctx;
5070         wlc_txq_info_t *qi = wlc->active_queue; /* Check me */
5071         struct pktq *q = &qi->q;
5072         int prio;
5073
5074         prio = sdu->priority;
5075
5076         ASSERT(pktq_max(q) >= wlc->pub->tunables->datahiwat);
5077
5078         if (!wlc_prec_enq(wlc, q, sdu, prec)) {
5079                 if (!EDCF_ENAB(wlc->pub)
5080                     || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL))
5081                         WL_ERROR(("wl%d: wlc_txq_enq: txq overflow\n",
5082                                   wlc->pub->unit));
5083
5084                 /* ASSERT(9 == 8); *//* XXX we might hit this condtion in case packet flooding from mac80211 stack */
5085                 PKTFREE(wlc->osh, sdu, true);
5086                 WLCNTINCR(wlc->pub->_cnt->txnobuf);
5087         }
5088
5089         /* Check if flow control needs to be turned on after enqueuing the packet
5090          *   Don't turn on flow control if EDCF is enabled. Driver would make the decision on what
5091          *   to drop instead of relying on stack to make the right decision
5092          */
5093         if (!EDCF_ENAB(wlc->pub)
5094             || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL)) {
5095                 if (pktq_len(q) >= wlc->pub->tunables->datahiwat) {
5096                         wlc_txflowcontrol(wlc, qi, ON, ALLPRIO);
5097                 }
5098         } else if (wlc->pub->_priofc) {
5099                 if (pktq_plen(q, wlc_prio2prec_map[prio]) >=
5100                     wlc->pub->tunables->datahiwat) {
5101                         wlc_txflowcontrol(wlc, qi, ON, prio);
5102                 }
5103         }
5104 }
5105
5106 bool BCMFASTPATH
5107 wlc_sendpkt_mac80211(wlc_info_t *wlc, struct sk_buff *sdu,
5108                      struct ieee80211_hw *hw)
5109 {
5110         u8 prio;
5111         uint fifo;
5112         void *pkt;
5113         struct scb *scb = &global_scb;
5114         struct dot11_header *d11_header = (struct dot11_header *)(sdu->data);
5115         u16 type, fc;
5116
5117         ASSERT(sdu);
5118
5119         fc = ltoh16(d11_header->fc);
5120         type = FC_TYPE(fc);
5121
5122         /* 802.11 standard requires management traffic to go at highest priority */
5123         prio = (type == FC_TYPE_DATA ? sdu->priority : MAXPRIO);
5124         fifo = prio2fifo[prio];
5125
5126         ASSERT((uint) PKTHEADROOM(sdu) >= TXOFF);
5127         ASSERT(!(sdu->cloned));
5128         ASSERT(!(sdu->next));
5129         ASSERT(!(sdu->prev));
5130         ASSERT(fifo < NFIFO);
5131
5132         pkt = sdu;
5133         if (unlikely
5134             (wlc_d11hdrs_mac80211(wlc, hw, pkt, scb, 0, 1, fifo, 0, NULL, 0)))
5135                 return -EINVAL;
5136         wlc_txq_enq(wlc, scb, pkt, WLC_PRIO_TO_PREC(prio));
5137         wlc_send_q(wlc, wlc->active_queue);
5138
5139         WLCNTINCR(wlc->pub->_cnt->ieee_tx);
5140         return 0;
5141 }
5142
5143 void BCMFASTPATH wlc_send_q(wlc_info_t *wlc, wlc_txq_info_t *qi)
5144 {
5145         struct sk_buff *pkt[DOT11_MAXNUMFRAGS];
5146         int prec;
5147         u16 prec_map;
5148         int err = 0, i, count;
5149         uint fifo;
5150         struct pktq *q = &qi->q;
5151         struct ieee80211_tx_info *tx_info;
5152
5153         /* only do work for the active queue */
5154         if (qi != wlc->active_queue)
5155                 return;
5156
5157         if (in_send_q)
5158                 return;
5159         else
5160                 in_send_q = true;
5161
5162         prec_map = wlc->tx_prec_map;
5163
5164         /* Send all the enq'd pkts that we can.
5165          * Dequeue packets with precedence with empty HW fifo only
5166          */
5167         while (prec_map && (pkt[0] = pktq_mdeq(q, prec_map, &prec))) {
5168                 tx_info = IEEE80211_SKB_CB(pkt[0]);
5169                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
5170                         err = wlc_sendampdu(wlc->ampdu, qi, pkt, prec);
5171                 } else {
5172                         count = 1;
5173                         err = wlc_prep_pdu(wlc, pkt[0], &fifo);
5174                         if (!err) {
5175                                 for (i = 0; i < count; i++) {
5176                                         wlc_txfifo(wlc, fifo, pkt[i], true, 1);
5177                                 }
5178                         }
5179                 }
5180
5181                 if (err == BCME_BUSY) {
5182                         pktq_penq_head(q, prec, pkt[0]);
5183                         /* If send failed due to any other reason than a change in
5184                          * HW FIFO condition, quit. Otherwise, read the new prec_map!
5185                          */
5186                         if (prec_map == wlc->tx_prec_map)
5187                                 break;
5188                         prec_map = wlc->tx_prec_map;
5189                 }
5190         }
5191
5192         /* Check if flow control needs to be turned off after sending the packet */
5193         if (!EDCF_ENAB(wlc->pub)
5194             || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL)) {
5195                 if (wlc_txflowcontrol_prio_isset(wlc, qi, ALLPRIO)
5196                     && (pktq_len(q) < wlc->pub->tunables->datahiwat / 2)) {
5197                         wlc_txflowcontrol(wlc, qi, OFF, ALLPRIO);
5198                 }
5199         } else if (wlc->pub->_priofc) {
5200                 int prio;
5201                 for (prio = MAXPRIO; prio >= 0; prio--) {
5202                         if (wlc_txflowcontrol_prio_isset(wlc, qi, prio) &&
5203                             (pktq_plen(q, wlc_prio2prec_map[prio]) <
5204                              wlc->pub->tunables->datahiwat / 2)) {
5205                                 wlc_txflowcontrol(wlc, qi, OFF, prio);
5206                         }
5207                 }
5208         }
5209         in_send_q = false;
5210 }
5211
5212 /*
5213  * bcmc_fid_generate:
5214  * Generate frame ID for a BCMC packet.  The frag field is not used
5215  * for MC frames so is used as part of the sequence number.
5216  */
5217 static inline u16
5218 bcmc_fid_generate(wlc_info_t *wlc, wlc_bsscfg_t *bsscfg, d11txh_t *txh)
5219 {
5220         u16 frameid;
5221
5222         frameid = ltoh16(txh->TxFrameID) & ~(TXFID_SEQ_MASK | TXFID_QUEUE_MASK);
5223         frameid |=
5224             (((wlc->
5225                mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5226             TX_BCMC_FIFO;
5227
5228         return frameid;
5229 }
5230
5231 void BCMFASTPATH
5232 wlc_txfifo(wlc_info_t *wlc, uint fifo, struct sk_buff *p, bool commit,
5233            s8 txpktpend)
5234 {
5235         u16 frameid = INVALIDFID;
5236         d11txh_t *txh;
5237
5238         ASSERT(fifo < NFIFO);
5239         txh = (d11txh_t *) (p->data);
5240
5241         /* When a BC/MC frame is being committed to the BCMC fifo via DMA (NOT PIO), update
5242          * ucode or BSS info as appropriate.
5243          */
5244         if (fifo == TX_BCMC_FIFO) {
5245                 frameid = ltoh16(txh->TxFrameID);
5246
5247         }
5248
5249         if (WLC_WAR16165(wlc))
5250                 wlc_war16165(wlc, true);
5251
5252
5253         /* Bump up pending count for if not using rpc. If rpc is used, this will be handled
5254          * in wlc_bmac_txfifo()
5255          */
5256         if (commit) {
5257                 TXPKTPENDINC(wlc, fifo, txpktpend);
5258                 WL_TRACE(("wlc_txfifo, pktpend inc %d to %d\n", txpktpend,
5259                           TXPKTPENDGET(wlc, fifo)));
5260         }
5261
5262         /* Commit BCMC sequence number in the SHM frame ID location */
5263         if (frameid != INVALIDFID)
5264                 BCMCFID(wlc, frameid);
5265
5266         if (dma_txfast(wlc->hw->di[fifo], p, commit) < 0) {
5267                 WL_ERROR(("wlc_txfifo: fatal, toss frames !!!\n"));
5268         }
5269 }
5270
5271 static u16
5272 wlc_compute_airtime(wlc_info_t *wlc, ratespec_t rspec, uint length)
5273 {
5274         u16 usec = 0;
5275         uint mac_rate = RSPEC2RATE(rspec);
5276         uint nsyms;
5277
5278         if (IS_MCS(rspec)) {
5279                 /* not supported yet */
5280                 ASSERT(0);
5281         } else if (IS_OFDM(rspec)) {
5282                 /* nsyms = Ceiling(Nbits / (Nbits/sym))
5283                  *
5284                  * Nbits = length * 8
5285                  * Nbits/sym = Mbps * 4 = mac_rate * 2
5286                  */
5287                 nsyms = CEIL((length * 8), (mac_rate * 2));
5288
5289                 /* usec = symbols * usec/symbol */
5290                 usec = (u16) (nsyms * APHY_SYMBOL_TIME);
5291                 return usec;
5292         } else {
5293                 switch (mac_rate) {
5294                 case WLC_RATE_1M:
5295                         usec = length << 3;
5296                         break;
5297                 case WLC_RATE_2M:
5298                         usec = length << 2;
5299                         break;
5300                 case WLC_RATE_5M5:
5301                         usec = (length << 4) / 11;
5302                         break;
5303                 case WLC_RATE_11M:
5304                         usec = (length << 3) / 11;
5305                         break;
5306                 default:
5307                         WL_ERROR(("wl%d: wlc_compute_airtime: unsupported rspec 0x%x\n", wlc->pub->unit, rspec));
5308                         ASSERT((const char *)"Bad phy_rate" == NULL);
5309                         break;
5310                 }
5311         }
5312
5313         return usec;
5314 }
5315
5316 void BCMFASTPATH
5317 wlc_compute_plcp(wlc_info_t *wlc, ratespec_t rspec, uint length, u8 *plcp)
5318 {
5319         if (IS_MCS(rspec)) {
5320                 wlc_compute_mimo_plcp(rspec, length, plcp);
5321         } else if (IS_OFDM(rspec)) {
5322                 wlc_compute_ofdm_plcp(rspec, length, plcp);
5323         } else {
5324                 wlc_compute_cck_plcp(rspec, length, plcp);
5325         }
5326         return;
5327 }
5328
5329 /* Rate: 802.11 rate code, length: PSDU length in octets */
5330 static void wlc_compute_mimo_plcp(ratespec_t rspec, uint length, u8 *plcp)
5331 {
5332         u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
5333         ASSERT(IS_MCS(rspec));
5334         plcp[0] = mcs;
5335         if (RSPEC_IS40MHZ(rspec) || (mcs == 32))
5336                 plcp[0] |= MIMO_PLCP_40MHZ;
5337         WLC_SET_MIMO_PLCP_LEN(plcp, length);
5338         plcp[3] = RSPEC_MIMOPLCP3(rspec);       /* rspec already holds this byte */
5339         plcp[3] |= 0x7;         /* set smoothing, not sounding ppdu & reserved */
5340         plcp[4] = 0;            /* number of extension spatial streams bit 0 & 1 */
5341         plcp[5] = 0;
5342 }
5343
5344 /* Rate: 802.11 rate code, length: PSDU length in octets */
5345 static void BCMFASTPATH
5346 wlc_compute_ofdm_plcp(ratespec_t rspec, u32 length, u8 *plcp)
5347 {
5348         u8 rate_signal;
5349         u32 tmp = 0;
5350         int rate = RSPEC2RATE(rspec);
5351
5352         ASSERT(IS_OFDM(rspec));
5353
5354         /* encode rate per 802.11a-1999 sec 17.3.4.1, with lsb transmitted first */
5355         rate_signal = rate_info[rate] & RATE_MASK;
5356         ASSERT(rate_signal != 0);
5357
5358         bzero(plcp, D11_PHY_HDR_LEN);
5359         D11A_PHY_HDR_SRATE((ofdm_phy_hdr_t *) plcp, rate_signal);
5360
5361         tmp = (length & 0xfff) << 5;
5362         plcp[2] |= (tmp >> 16) & 0xff;
5363         plcp[1] |= (tmp >> 8) & 0xff;
5364         plcp[0] |= tmp & 0xff;
5365
5366         return;
5367 }
5368
5369 /*
5370  * Compute PLCP, but only requires actual rate and length of pkt.
5371  * Rate is given in the driver standard multiple of 500 kbps.
5372  * le is set for 11 Mbps rate if necessary.
5373  * Broken out for PRQ.
5374  */
5375
5376 static void wlc_cck_plcp_set(int rate_500, uint length, u8 *plcp)
5377 {
5378         u16 usec = 0;
5379         u8 le = 0;
5380
5381         switch (rate_500) {
5382         case WLC_RATE_1M:
5383                 usec = length << 3;
5384                 break;
5385         case WLC_RATE_2M:
5386                 usec = length << 2;
5387                 break;
5388         case WLC_RATE_5M5:
5389                 usec = (length << 4) / 11;
5390                 if ((length << 4) - (usec * 11) > 0)
5391                         usec++;
5392                 break;
5393         case WLC_RATE_11M:
5394                 usec = (length << 3) / 11;
5395                 if ((length << 3) - (usec * 11) > 0) {
5396                         usec++;
5397                         if ((usec * 11) - (length << 3) >= 8)
5398                                 le = D11B_PLCP_SIGNAL_LE;
5399                 }
5400                 break;
5401
5402         default:
5403                 WL_ERROR(("wlc_cck_plcp_set: unsupported rate %d\n", rate_500));
5404                 rate_500 = WLC_RATE_1M;
5405                 usec = length << 3;
5406                 break;
5407         }
5408         /* PLCP signal byte */
5409         plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
5410         /* PLCP service byte */
5411         plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
5412         /* PLCP length u16, little endian */
5413         plcp[2] = usec & 0xff;
5414         plcp[3] = (usec >> 8) & 0xff;
5415         /* PLCP CRC16 */
5416         plcp[4] = 0;
5417         plcp[5] = 0;
5418 }
5419
5420 /* Rate: 802.11 rate code, length: PSDU length in octets */
5421 static void wlc_compute_cck_plcp(ratespec_t rspec, uint length, u8 *plcp)
5422 {
5423         int rate = RSPEC2RATE(rspec);
5424
5425         ASSERT(IS_CCK(rspec));
5426
5427         wlc_cck_plcp_set(rate, length, plcp);
5428 }
5429
5430 /* wlc_compute_frame_dur()
5431  *
5432  * Calculate the 802.11 MAC header DUR field for MPDU
5433  * DUR for a single frame = 1 SIFS + 1 ACK
5434  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5435  *
5436  * rate                 MPDU rate in unit of 500kbps
5437  * next_frag_len        next MPDU length in bytes
5438  * preamble_type        use short/GF or long/MM PLCP header
5439  */
5440 static u16 BCMFASTPATH
5441 wlc_compute_frame_dur(wlc_info_t *wlc, ratespec_t rate, u8 preamble_type,
5442                       uint next_frag_len)
5443 {
5444         u16 dur, sifs;
5445
5446         sifs = SIFS(wlc->band);
5447
5448         dur = sifs;
5449         dur += (u16) wlc_calc_ack_time(wlc, rate, preamble_type);
5450
5451         if (next_frag_len) {
5452                 /* Double the current DUR to get 2 SIFS + 2 ACKs */
5453                 dur *= 2;
5454                 /* add another SIFS and the frag time */
5455                 dur += sifs;
5456                 dur +=
5457                     (u16) wlc_calc_frame_time(wlc, rate, preamble_type,
5458                                                  next_frag_len);
5459         }
5460         return dur;
5461 }
5462
5463 /* wlc_compute_rtscts_dur()
5464  *
5465  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
5466  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
5467  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
5468  *
5469  * cts                  cts-to-self or rts/cts
5470  * rts_rate             rts or cts rate in unit of 500kbps
5471  * rate                 next MPDU rate in unit of 500kbps
5472  * frame_len            next MPDU frame length in bytes
5473  */
5474 u16 BCMFASTPATH
5475 wlc_compute_rtscts_dur(wlc_info_t *wlc, bool cts_only, ratespec_t rts_rate,
5476                        ratespec_t frame_rate, u8 rts_preamble_type,
5477                        u8 frame_preamble_type, uint frame_len, bool ba)
5478 {
5479         u16 dur, sifs;
5480
5481         sifs = SIFS(wlc->band);
5482
5483         if (!cts_only) {        /* RTS/CTS */
5484                 dur = 3 * sifs;
5485                 dur +=
5486                     (u16) wlc_calc_cts_time(wlc, rts_rate,
5487                                                rts_preamble_type);
5488         } else {                /* CTS-TO-SELF */
5489                 dur = 2 * sifs;
5490         }
5491
5492         dur +=
5493             (u16) wlc_calc_frame_time(wlc, frame_rate, frame_preamble_type,
5494                                          frame_len);
5495         if (ba)
5496                 dur +=
5497                     (u16) wlc_calc_ba_time(wlc, frame_rate,
5498                                               WLC_SHORT_PREAMBLE);
5499         else
5500                 dur +=
5501                     (u16) wlc_calc_ack_time(wlc, frame_rate,
5502                                                frame_preamble_type);
5503         return dur;
5504 }
5505
5506 static bool wlc_phy_rspec_check(wlc_info_t *wlc, u16 bw, ratespec_t rspec)
5507 {
5508         if (IS_MCS(rspec)) {
5509                 uint mcs = rspec & RSPEC_RATE_MASK;
5510
5511                 if (mcs < 8) {
5512                         ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_SDM);
5513                 } else if ((mcs >= 8) && (mcs <= 23)) {
5514                         ASSERT(RSPEC_STF(rspec) == PHY_TXC1_MODE_SDM);
5515                 } else if (mcs == 32) {
5516                         ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_SDM);
5517                         ASSERT(bw == PHY_TXC1_BW_40MHZ_DUP);
5518                 }
5519         } else if (IS_OFDM(rspec)) {
5520                 ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_STBC);
5521         } else {
5522                 ASSERT(IS_CCK(rspec));
5523
5524                 ASSERT((bw == PHY_TXC1_BW_20MHZ)
5525                        || (bw == PHY_TXC1_BW_20MHZ_UP));
5526                 ASSERT(RSPEC_STF(rspec) == PHY_TXC1_MODE_SISO);
5527         }
5528
5529         return true;
5530 }
5531
5532 u16 BCMFASTPATH wlc_phytxctl1_calc(wlc_info_t *wlc, ratespec_t rspec)
5533 {
5534         u16 phyctl1 = 0;
5535         u16 bw;
5536
5537         if (WLCISLCNPHY(wlc->band)) {
5538                 bw = PHY_TXC1_BW_20MHZ;
5539         } else {
5540                 bw = RSPEC_GET_BW(rspec);
5541                 /* 10Mhz is not supported yet */
5542                 if (bw < PHY_TXC1_BW_20MHZ) {
5543                         WL_ERROR(("wlc_phytxctl1_calc: bw %d is not supported yet, set to 20L\n", bw));
5544                         bw = PHY_TXC1_BW_20MHZ;
5545                 }
5546
5547                 wlc_phy_rspec_check(wlc, bw, rspec);
5548         }
5549
5550         if (IS_MCS(rspec)) {
5551                 uint mcs = rspec & RSPEC_RATE_MASK;
5552
5553                 /* bw, stf, coding-type is part of RSPEC_PHYTXBYTE2 returns */
5554                 phyctl1 = RSPEC_PHYTXBYTE2(rspec);
5555                 /* set the upper byte of phyctl1 */
5556                 phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
5557         } else if (IS_CCK(rspec) && !WLCISLCNPHY(wlc->band)
5558                    && !WLCISSSLPNPHY(wlc->band)) {
5559                 /* In CCK mode LPPHY overloads OFDM Modulation bits with CCK Data Rate */
5560                 /* Eventually MIMOPHY would also be converted to this format */
5561                 /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
5562                 phyctl1 = (bw | (RSPEC_STF(rspec) << PHY_TXC1_MODE_SHIFT));
5563         } else {                /* legacy OFDM/CCK */
5564                 s16 phycfg;
5565                 /* get the phyctl byte from rate phycfg table */
5566                 phycfg = wlc_rate_legacy_phyctl(RSPEC2RATE(rspec));
5567                 if (phycfg == -1) {
5568                         WL_ERROR(("wlc_phytxctl1_calc: wrong legacy OFDM/CCK rate\n"));
5569                         ASSERT(0);
5570                         phycfg = 0;
5571                 }
5572                 /* set the upper byte of phyctl1 */
5573                 phyctl1 =
5574                     (bw | (phycfg << 8) |
5575                      (RSPEC_STF(rspec) << PHY_TXC1_MODE_SHIFT));
5576         }
5577
5578 #ifdef BCMDBG
5579         /* phy clock must support 40Mhz if tx descriptor uses it */
5580         if ((phyctl1 & PHY_TXC1_BW_MASK) >= PHY_TXC1_BW_40MHZ) {
5581                 ASSERT(CHSPEC_WLC_BW(wlc->chanspec) == WLC_40_MHZ);
5582                 ASSERT(wlc->chanspec == wlc_phy_chanspec_get(wlc->band->pi));
5583         }
5584 #endif                          /* BCMDBG */
5585         return phyctl1;
5586 }
5587
5588 ratespec_t BCMFASTPATH
5589 wlc_rspec_to_rts_rspec(wlc_info_t *wlc, ratespec_t rspec, bool use_rspec,
5590                        u16 mimo_ctlchbw)
5591 {
5592         ratespec_t rts_rspec = 0;
5593
5594         if (use_rspec) {
5595                 /* use frame rate as rts rate */
5596                 rts_rspec = rspec;
5597
5598         } else if (wlc->band->gmode && wlc->protection->_g && !IS_CCK(rspec)) {
5599                 /* Use 11Mbps as the g protection RTS target rate and fallback.
5600                  * Use the WLC_BASIC_RATE() lookup to find the best basic rate under the
5601                  * target in case 11 Mbps is not Basic.
5602                  * 6 and 9 Mbps are not usually selected by rate selection, but even
5603                  * if the OFDM rate we are protecting is 6 or 9 Mbps, 11 is more robust.
5604                  */
5605                 rts_rspec = WLC_BASIC_RATE(wlc, WLC_RATE_11M);
5606         } else {
5607                 /* calculate RTS rate and fallback rate based on the frame rate
5608                  * RTS must be sent at a basic rate since it is a
5609                  * control frame, sec 9.6 of 802.11 spec
5610                  */
5611                 rts_rspec = WLC_BASIC_RATE(wlc, rspec);
5612         }
5613
5614         if (WLC_PHY_11N_CAP(wlc->band)) {
5615                 /* set rts txbw to correct side band */
5616                 rts_rspec &= ~RSPEC_BW_MASK;
5617
5618                 /* if rspec/rspec_fallback is 40MHz, then send RTS on both 20MHz channel
5619                  * (DUP), otherwise send RTS on control channel
5620                  */
5621                 if (RSPEC_IS40MHZ(rspec) && !IS_CCK(rts_rspec))
5622                         rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
5623                 else
5624                         rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
5625
5626                 /* pick siso/cdd as default for ofdm */
5627                 if (IS_OFDM(rts_rspec)) {
5628                         rts_rspec &= ~RSPEC_STF_MASK;
5629                         rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
5630                 }
5631         }
5632         return rts_rspec;
5633 }
5634
5635 /*
5636  * Add d11txh_t, cck_phy_hdr_t.
5637  *
5638  * 'p' data must start with 802.11 MAC header
5639  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
5640  *
5641  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
5642  *
5643  */
5644 static u16 BCMFASTPATH
5645 wlc_d11hdrs_mac80211(wlc_info_t *wlc, struct ieee80211_hw *hw,
5646                      struct sk_buff *p, struct scb *scb, uint frag,
5647                      uint nfrags, uint queue, uint next_frag_len,
5648                      wsec_key_t *key, ratespec_t rspec_override)
5649 {
5650         struct dot11_header *h;
5651         d11txh_t *txh;
5652         u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
5653         struct osl_info *osh;
5654         int len, phylen, rts_phylen;
5655         u16 fc, type, frameid, mch, phyctl, xfts, mainrates;
5656         u16 seq = 0, mcl = 0, status = 0;
5657         ratespec_t rspec[2] = { WLC_RATE_1M, WLC_RATE_1M }, rts_rspec[2] = {
5658         WLC_RATE_1M, WLC_RATE_1M};
5659         bool use_rts = false;
5660         bool use_cts = false;
5661         bool use_rifs = false;
5662         bool short_preamble[2] = { false, false };
5663         u8 preamble_type[2] = { WLC_LONG_PREAMBLE, WLC_LONG_PREAMBLE };
5664         u8 rts_preamble_type[2] = { WLC_LONG_PREAMBLE, WLC_LONG_PREAMBLE };
5665         u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
5666         struct dot11_rts_frame *rts = NULL;
5667         bool qos;
5668         uint ac;
5669         u32 rate_val[2];
5670         bool hwtkmic = false;
5671         u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
5672 #ifdef WLANTSEL
5673 #define ANTCFG_NONE 0xFF
5674         u8 antcfg = ANTCFG_NONE;
5675         u8 fbantcfg = ANTCFG_NONE;
5676 #endif
5677         uint phyctl1_stf = 0;
5678         u16 durid = 0;
5679         struct ieee80211_tx_rate *txrate[2];
5680         int k;
5681         struct ieee80211_tx_info *tx_info;
5682         bool is_mcs[2];
5683         u16 mimo_txbw;
5684         u8 mimo_preamble_type;
5685
5686         frameid = 0;
5687
5688         ASSERT(queue < NFIFO);
5689
5690         osh = wlc->osh;
5691
5692         /* locate 802.11 MAC header */
5693         h = (struct dot11_header *)(p->data);
5694         fc = ltoh16(h->fc);
5695         type = FC_TYPE(fc);
5696
5697         qos = (type == FC_TYPE_DATA && FC_SUBTYPE_ANY_QOS(FC_SUBTYPE(fc)));
5698
5699         /* compute length of frame in bytes for use in PLCP computations */
5700         len = pkttotlen(osh, p);
5701         phylen = len + DOT11_FCS_LEN;
5702
5703         /* If WEP enabled, add room in phylen for the additional bytes of
5704          * ICV which MAC generates.  We do NOT add the additional bytes to
5705          * the packet itself, thus phylen = packet length + ICV_LEN + FCS_LEN
5706          * in this case
5707          */
5708         if (key) {
5709                 phylen += key->icv_len;
5710         }
5711
5712         /* Get tx_info */
5713         tx_info = IEEE80211_SKB_CB(p);
5714         ASSERT(tx_info);
5715
5716         /* add PLCP */
5717         plcp = skb_push(p, D11_PHY_HDR_LEN);
5718
5719         /* add Broadcom tx descriptor header */
5720         txh = (d11txh_t *) skb_push(p, D11_TXH_LEN);
5721         bzero((char *)txh, D11_TXH_LEN);
5722
5723         /* setup frameid */
5724         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
5725                 /* non-AP STA should never use BCMC queue */
5726                 ASSERT(queue != TX_BCMC_FIFO);
5727                 if (queue == TX_BCMC_FIFO) {
5728                         WL_ERROR(("wl%d: %s: ASSERT queue == TX_BCMC!\n",
5729                                   WLCWLUNIT(wlc), __func__));
5730                         frameid = bcmc_fid_generate(wlc, NULL, txh);
5731                 } else {
5732                         /* Increment the counter for first fragment */
5733                         if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT) {
5734                                 SCB_SEQNUM(scb, p->priority)++;
5735                         }
5736
5737                         /* extract fragment number from frame first */
5738                         seq = ltoh16(seq) & FRAGNUM_MASK;
5739                         seq |= (SCB_SEQNUM(scb, p->priority) << SEQNUM_SHIFT);
5740                         h->seq = htol16(seq);
5741
5742                         frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5743                             (queue & TXFID_QUEUE_MASK);
5744                 }
5745         }
5746         frameid |= queue & TXFID_QUEUE_MASK;
5747
5748         /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
5749         if (SCB_PS(scb) || ((fc & FC_KIND_MASK) == FC_BEACON))
5750                 mcl |= TXC_IGNOREPMQ;
5751
5752         ASSERT(hw->max_rates <= IEEE80211_TX_MAX_RATES);
5753         ASSERT(hw->max_rates == 2);
5754
5755         txrate[0] = tx_info->control.rates;
5756         txrate[1] = txrate[0] + 1;
5757
5758         ASSERT(txrate[0]->idx >= 0);
5759         /* if rate control algorithm didn't give us a fallback rate, use the primary rate */
5760         if (txrate[1]->idx < 0) {
5761                 txrate[1] = txrate[0];
5762         }
5763
5764         for (k = 0; k < hw->max_rates; k++) {
5765                 is_mcs[k] =
5766                     txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
5767                 if (!is_mcs[k]) {
5768                         ASSERT(!(tx_info->flags & IEEE80211_TX_CTL_AMPDU));
5769                         if ((txrate[k]->idx >= 0)
5770                             && (txrate[k]->idx <
5771                                 hw->wiphy->bands[tx_info->band]->n_bitrates)) {
5772                                 rate_val[k] =
5773                                     hw->wiphy->bands[tx_info->band]->
5774                                     bitrates[txrate[k]->idx].hw_value;
5775                                 short_preamble[k] =
5776                                     txrate[k]->
5777                                     flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
5778                                     true : false;
5779                         } else {
5780                                 ASSERT((txrate[k]->idx >= 0) &&
5781                                        (txrate[k]->idx <
5782                                         hw->wiphy->bands[tx_info->band]->
5783                                         n_bitrates));
5784                                 rate_val[k] = WLC_RATE_1M;
5785                         }
5786                 } else {
5787                         rate_val[k] = txrate[k]->idx;
5788                 }
5789                 /* Currently only support same setting for primay and fallback rates.
5790                  * Unify flags for each rate into a single value for the frame
5791                  */
5792                 use_rts |=
5793                     txrate[k]->
5794                     flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
5795                 use_cts |=
5796                     txrate[k]->
5797                     flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
5798
5799                 if (is_mcs[k])
5800                         rate_val[k] |= NRATE_MCS_INUSE;
5801
5802                 rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band, rate_val[k]);
5803
5804                 /* (1) RATE: determine and validate primary rate and fallback rates */
5805                 if (!RSPEC_ACTIVE(rspec[k])) {
5806                         ASSERT(RSPEC_ACTIVE(rspec[k]));
5807                         rspec[k] = WLC_RATE_1M;
5808                 } else {
5809                         if (WLANTSEL_ENAB(wlc) && !ETHER_ISMULTI(&h->a1)) {
5810                                 /* set tx antenna config */
5811                                 wlc_antsel_antcfg_get(wlc->asi, false, false, 0,
5812                                                       0, &antcfg, &fbantcfg);
5813                         }
5814                 }
5815         }
5816
5817         phyctl1_stf = wlc->stf->ss_opmode;
5818
5819         if (N_ENAB(wlc->pub)) {
5820                 for (k = 0; k < hw->max_rates; k++) {
5821                         /* apply siso/cdd to single stream mcs's or ofdm if rspec is auto selected */
5822                         if (((IS_MCS(rspec[k]) &&
5823                               IS_SINGLE_STREAM(rspec[k] & RSPEC_RATE_MASK)) ||
5824                              IS_OFDM(rspec[k]))
5825                             && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
5826                                 || !(rspec[k] & RSPEC_OVERRIDE))) {
5827                                 rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
5828
5829                                 /* For SISO MCS use STBC if possible */
5830                                 if (IS_MCS(rspec[k])
5831                                     && WLC_STF_SS_STBC_TX(wlc, scb)) {
5832                                         u8 stc;
5833
5834                                         ASSERT(WLC_STBC_CAP_PHY(wlc));
5835                                         stc = 1;        /* Nss for single stream is always 1 */
5836                                         rspec[k] |=
5837                                             (PHY_TXC1_MODE_STBC <<
5838                                              RSPEC_STF_SHIFT) | (stc <<
5839                                                                  RSPEC_STC_SHIFT);
5840                                 } else
5841                                         rspec[k] |=
5842                                             (phyctl1_stf << RSPEC_STF_SHIFT);
5843                         }
5844
5845                         /* Is the phy configured to use 40MHZ frames? If so then pick the desired txbw */
5846                         if (CHSPEC_WLC_BW(wlc->chanspec) == WLC_40_MHZ) {
5847                                 /* default txbw is 20in40 SB */
5848                                 mimo_ctlchbw = mimo_txbw =
5849                                     CHSPEC_SB_UPPER(WLC_BAND_PI_RADIO_CHANSPEC)
5850                                     ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
5851
5852                                 if (IS_MCS(rspec[k])) {
5853                                         /* mcs 32 must be 40b/w DUP */
5854                                         if ((rspec[k] & RSPEC_RATE_MASK) == 32) {
5855                                                 mimo_txbw =
5856                                                     PHY_TXC1_BW_40MHZ_DUP;
5857                                                 /* use override */
5858                                         } else if (wlc->mimo_40txbw != AUTO)
5859                                                 mimo_txbw = wlc->mimo_40txbw;
5860                                         /* else check if dst is using 40 Mhz */
5861                                         else if (scb->flags & SCB_IS40)
5862                                                 mimo_txbw = PHY_TXC1_BW_40MHZ;
5863                                 } else if (IS_OFDM(rspec[k])) {
5864                                         if (wlc->ofdm_40txbw != AUTO)
5865                                                 mimo_txbw = wlc->ofdm_40txbw;
5866                                 } else {
5867                                         ASSERT(IS_CCK(rspec[k]));
5868                                         if (wlc->cck_40txbw != AUTO)
5869                                                 mimo_txbw = wlc->cck_40txbw;
5870                                 }
5871                         } else {
5872                                 /* mcs32 is 40 b/w only.
5873                                  * This is possible for probe packets on a STA during SCAN
5874                                  */
5875                                 if ((rspec[k] & RSPEC_RATE_MASK) == 32) {
5876                                         /* mcs 0 */
5877                                         rspec[k] = RSPEC_MIMORATE;
5878                                 }
5879                                 mimo_txbw = PHY_TXC1_BW_20MHZ;
5880                         }
5881
5882                         /* Set channel width */
5883                         rspec[k] &= ~RSPEC_BW_MASK;
5884                         if ((k == 0) || ((k > 0) && IS_MCS(rspec[k])))
5885                                 rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
5886                         else
5887                                 rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
5888
5889                         /* Set Short GI */
5890 #ifdef NOSGIYET
5891                         if (IS_MCS(rspec[k])
5892                             && (txrate[k]->flags & IEEE80211_TX_RC_SHORT_GI))
5893                                 rspec[k] |= RSPEC_SHORT_GI;
5894                         else if (!(txrate[k]->flags & IEEE80211_TX_RC_SHORT_GI))
5895                                 rspec[k] &= ~RSPEC_SHORT_GI;
5896 #else
5897                         rspec[k] &= ~RSPEC_SHORT_GI;
5898 #endif
5899
5900                         mimo_preamble_type = WLC_MM_PREAMBLE;
5901                         if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
5902                                 mimo_preamble_type = WLC_GF_PREAMBLE;
5903
5904                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
5905                             && (!IS_MCS(rspec[k]))) {
5906                                 WL_ERROR(("wl%d: %s: IEEE80211_TX_RC_MCS != IS_MCS(rspec)\n", WLCWLUNIT(wlc), __func__));
5907                                 ASSERT(0 && "Rate mismatch");
5908                         }
5909
5910                         if (IS_MCS(rspec[k])) {
5911                                 preamble_type[k] = mimo_preamble_type;
5912
5913                                 /* if SGI is selected, then forced mm for single stream */
5914                                 if ((rspec[k] & RSPEC_SHORT_GI)
5915                                     && IS_SINGLE_STREAM(rspec[k] &
5916                                                         RSPEC_RATE_MASK)) {
5917                                         preamble_type[k] = WLC_MM_PREAMBLE;
5918                                 }
5919                         }
5920
5921                         /* mimo bw field MUST now be valid in the rspec (it affects duration calculations) */
5922                         ASSERT(VALID_RATE_DBG(wlc, rspec[0]));
5923
5924                         /* should be better conditionalized */
5925                         if (!IS_MCS(rspec[0])
5926                             && (tx_info->control.rates[0].
5927                                 flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
5928                                 preamble_type[k] = WLC_SHORT_PREAMBLE;
5929
5930                         ASSERT(!IS_MCS(rspec[0])
5931                                || WLC_IS_MIMO_PREAMBLE(preamble_type[k]));
5932                 }
5933         } else {
5934                 for (k = 0; k < hw->max_rates; k++) {
5935                         /* Set ctrlchbw as 20Mhz */
5936                         ASSERT(!IS_MCS(rspec[k]));
5937                         rspec[k] &= ~RSPEC_BW_MASK;
5938                         rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
5939
5940                         /* for nphy, stf of ofdm frames must follow policies */
5941                         if (WLCISNPHY(wlc->band) && IS_OFDM(rspec[k])) {
5942                                 rspec[k] &= ~RSPEC_STF_MASK;
5943                                 rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
5944                         }
5945                 }
5946         }
5947
5948         /* Reset these for use with AMPDU's */
5949         txrate[0]->count = 0;
5950         txrate[1]->count = 0;
5951
5952         /* (3) PLCP: determine PLCP header and MAC duration, fill d11txh_t */
5953         wlc_compute_plcp(wlc, rspec[0], phylen, plcp);
5954         wlc_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
5955         bcopy(plcp_fallback, (char *)&txh->FragPLCPFallback,
5956               sizeof(txh->FragPLCPFallback));
5957
5958         /* Length field now put in CCK FBR CRC field */
5959         if (IS_CCK(rspec[1])) {
5960                 txh->FragPLCPFallback[4] = phylen & 0xff;
5961                 txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
5962         }
5963
5964         /* MIMO-RATE: need validation ?? */
5965         mainrates =
5966             IS_OFDM(rspec[0]) ? D11A_PHY_HDR_GRATE((ofdm_phy_hdr_t *) plcp) :
5967             plcp[0];
5968
5969         /* DUR field for main rate */
5970         if ((fc != FC_PS_POLL) && !ETHER_ISMULTI(&h->a1) && !use_rifs) {
5971                 durid =
5972                     wlc_compute_frame_dur(wlc, rspec[0], preamble_type[0],
5973                                           next_frag_len);
5974                 h->durid = htol16(durid);
5975         } else if (use_rifs) {
5976                 /* NAV protect to end of next max packet size */
5977                 durid =
5978                     (u16) wlc_calc_frame_time(wlc, rspec[0],
5979                                                  preamble_type[0],
5980                                                  DOT11_MAX_FRAG_LEN);
5981                 durid += RIFS_11N_TIME;
5982                 h->durid = htol16(durid);
5983         }
5984
5985         /* DUR field for fallback rate */
5986         if (fc == FC_PS_POLL)
5987                 txh->FragDurFallback = h->durid;
5988         else if (ETHER_ISMULTI(&h->a1) || use_rifs)
5989                 txh->FragDurFallback = 0;
5990         else {
5991                 durid = wlc_compute_frame_dur(wlc, rspec[1],
5992                                               preamble_type[1], next_frag_len);
5993                 txh->FragDurFallback = htol16(durid);
5994         }
5995
5996         /* (4) MAC-HDR: MacTxControlLow */
5997         if (frag == 0)
5998                 mcl |= TXC_STARTMSDU;
5999
6000         if (!ETHER_ISMULTI(&h->a1))
6001                 mcl |= TXC_IMMEDACK;
6002
6003         if (BAND_5G(wlc->band->bandtype))
6004                 mcl |= TXC_FREQBAND_5G;
6005
6006         if (CHSPEC_IS40(WLC_BAND_PI_RADIO_CHANSPEC))
6007                 mcl |= TXC_BW_40;
6008
6009         /* set AMIC bit if using hardware TKIP MIC */
6010         if (hwtkmic)
6011                 mcl |= TXC_AMIC;
6012
6013         txh->MacTxControlLow = htol16(mcl);
6014
6015         /* MacTxControlHigh */
6016         mch = 0;
6017
6018         /* Set fallback rate preamble type */
6019         if ((preamble_type[1] == WLC_SHORT_PREAMBLE) ||
6020             (preamble_type[1] == WLC_GF_PREAMBLE)) {
6021                 ASSERT((preamble_type[1] == WLC_GF_PREAMBLE) ||
6022                        (!IS_MCS(rspec[1])));
6023                 if (RSPEC2RATE(rspec[1]) != WLC_RATE_1M)
6024                         mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6025         }
6026
6027         /* MacFrameControl */
6028         bcopy((char *)&h->fc, (char *)&txh->MacFrameControl, sizeof(u16));
6029
6030         txh->TxFesTimeNormal = htol16(0);
6031
6032         txh->TxFesTimeFallback = htol16(0);
6033
6034         /* TxFrameRA */
6035         bcopy((char *)&h->a1, (char *)&txh->TxFrameRA, ETHER_ADDR_LEN);
6036
6037         /* TxFrameID */
6038         txh->TxFrameID = htol16(frameid);
6039
6040         /* TxStatus, Note the case of recreating the first frag of a suppressed frame
6041          * then we may need to reset the retry cnt's via the status reg
6042          */
6043         txh->TxStatus = htol16(status);
6044
6045         if (D11REV_GE(wlc->pub->corerev, 16)) {
6046                 /* extra fields for ucode AMPDU aggregation, the new fields are added to
6047                  * the END of previous structure so that it's compatible in driver.
6048                  * In old rev ucode, these fields should be ignored
6049                  */
6050                 txh->MaxNMpdus = htol16(0);
6051                 txh->MaxABytes_MRT = htol16(0);
6052                 txh->MaxABytes_FBR = htol16(0);
6053                 txh->MinMBytes = htol16(0);
6054         }
6055
6056         /* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration, furnish d11txh_t */
6057         /* RTS PLCP header and RTS frame */
6058         if (use_rts || use_cts) {
6059                 if (use_rts && use_cts)
6060                         use_cts = false;
6061
6062                 for (k = 0; k < 2; k++) {
6063                         rts_rspec[k] = wlc_rspec_to_rts_rspec(wlc, rspec[k],
6064                                                               false,
6065                                                               mimo_ctlchbw);
6066                 }
6067
6068                 if (!IS_OFDM(rts_rspec[0]) &&
6069                     !((RSPEC2RATE(rts_rspec[0]) == WLC_RATE_1M) ||
6070                       (wlc->PLCPHdr_override == WLC_PLCP_LONG))) {
6071                         rts_preamble_type[0] = WLC_SHORT_PREAMBLE;
6072                         mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6073                 }
6074
6075                 if (!IS_OFDM(rts_rspec[1]) &&
6076                     !((RSPEC2RATE(rts_rspec[1]) == WLC_RATE_1M) ||
6077                       (wlc->PLCPHdr_override == WLC_PLCP_LONG))) {
6078                         rts_preamble_type[1] = WLC_SHORT_PREAMBLE;
6079                         mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6080                 }
6081
6082                 /* RTS/CTS additions to MacTxControlLow */
6083                 if (use_cts) {
6084                         txh->MacTxControlLow |= htol16(TXC_SENDCTS);
6085                 } else {
6086                         txh->MacTxControlLow |= htol16(TXC_SENDRTS);
6087                         txh->MacTxControlLow |= htol16(TXC_LONGFRAME);
6088                 }
6089
6090                 /* RTS PLCP header */
6091                 ASSERT(IS_ALIGNED((unsigned long)txh->RTSPhyHeader, sizeof(u16)));
6092                 rts_plcp = txh->RTSPhyHeader;
6093                 if (use_cts)
6094                         rts_phylen = DOT11_CTS_LEN + DOT11_FCS_LEN;
6095                 else
6096                         rts_phylen = DOT11_RTS_LEN + DOT11_FCS_LEN;
6097
6098                 wlc_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6099
6100                 /* fallback rate version of RTS PLCP header */
6101                 wlc_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6102                                  rts_plcp_fallback);
6103                 bcopy(rts_plcp_fallback, (char *)&txh->RTSPLCPFallback,
6104                       sizeof(txh->RTSPLCPFallback));
6105
6106                 /* RTS frame fields... */
6107                 rts = (struct dot11_rts_frame *)&txh->rts_frame;
6108
6109                 durid = wlc_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6110                                                rspec[0], rts_preamble_type[0],
6111                                                preamble_type[0], phylen, false);
6112                 rts->durid = htol16(durid);
6113                 /* fallback rate version of RTS DUR field */
6114                 durid = wlc_compute_rtscts_dur(wlc, use_cts,
6115                                                rts_rspec[1], rspec[1],
6116                                                rts_preamble_type[1],
6117                                                preamble_type[1], phylen, false);
6118                 txh->RTSDurFallback = htol16(durid);
6119
6120                 if (use_cts) {
6121                         rts->fc = htol16(FC_CTS);
6122                         bcopy((char *)&h->a2, (char *)&rts->ra, ETHER_ADDR_LEN);
6123                 } else {
6124                         rts->fc = htol16((u16) FC_RTS);
6125                         bcopy((char *)&h->a1, (char *)&rts->ra,
6126                               2 * ETHER_ADDR_LEN);
6127                 }
6128
6129                 /* mainrate
6130                  *    low 8 bits: main frag rate/mcs,
6131                  *    high 8 bits: rts/cts rate/mcs
6132                  */
6133                 mainrates |= (IS_OFDM(rts_rspec[0]) ?
6134                               D11A_PHY_HDR_GRATE((ofdm_phy_hdr_t *) rts_plcp) :
6135                               rts_plcp[0]) << 8;
6136         } else {
6137                 bzero((char *)txh->RTSPhyHeader, D11_PHY_HDR_LEN);
6138                 bzero((char *)&txh->rts_frame, sizeof(struct dot11_rts_frame));
6139                 bzero((char *)txh->RTSPLCPFallback,
6140                       sizeof(txh->RTSPLCPFallback));
6141                 txh->RTSDurFallback = 0;
6142         }
6143
6144 #ifdef SUPPORT_40MHZ
6145         /* add null delimiter count */
6146         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && IS_MCS(rspec)) {
6147                 txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6148                     wlc_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6149         }
6150 #endif
6151
6152         /* Now that RTS/RTS FB preamble types are updated, write the final value */
6153         txh->MacTxControlHigh = htol16(mch);
6154
6155         /* MainRates (both the rts and frag plcp rates have been calculated now) */
6156         txh->MainRates = htol16(mainrates);
6157
6158         /* XtraFrameTypes */
6159         xfts = FRAMETYPE(rspec[1], wlc->mimoft);
6160         xfts |= (FRAMETYPE(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6161         xfts |= (FRAMETYPE(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6162         xfts |=
6163             CHSPEC_CHANNEL(WLC_BAND_PI_RADIO_CHANSPEC) << XFTS_CHANNEL_SHIFT;
6164         txh->XtraFrameTypes = htol16(xfts);
6165
6166         /* PhyTxControlWord */
6167         phyctl = FRAMETYPE(rspec[0], wlc->mimoft);
6168         if ((preamble_type[0] == WLC_SHORT_PREAMBLE) ||
6169             (preamble_type[0] == WLC_GF_PREAMBLE)) {
6170                 ASSERT((preamble_type[0] == WLC_GF_PREAMBLE)
6171                        || !IS_MCS(rspec[0]));
6172                 if (RSPEC2RATE(rspec[0]) != WLC_RATE_1M)
6173                         phyctl |= PHY_TXC_SHORT_HDR;
6174                 WLCNTINCR(wlc->pub->_cnt->txprshort);
6175         }
6176
6177         /* phytxant is properly bit shifted */
6178         phyctl |= wlc_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6179         txh->PhyTxControlWord = htol16(phyctl);
6180
6181         /* PhyTxControlWord_1 */
6182         if (WLC_PHY_11N_CAP(wlc->band)) {
6183                 u16 phyctl1 = 0;
6184
6185                 phyctl1 = wlc_phytxctl1_calc(wlc, rspec[0]);
6186                 txh->PhyTxControlWord_1 = htol16(phyctl1);
6187                 phyctl1 = wlc_phytxctl1_calc(wlc, rspec[1]);
6188                 txh->PhyTxControlWord_1_Fbr = htol16(phyctl1);
6189
6190                 if (use_rts || use_cts) {
6191                         phyctl1 = wlc_phytxctl1_calc(wlc, rts_rspec[0]);
6192                         txh->PhyTxControlWord_1_Rts = htol16(phyctl1);
6193                         phyctl1 = wlc_phytxctl1_calc(wlc, rts_rspec[1]);
6194                         txh->PhyTxControlWord_1_FbrRts = htol16(phyctl1);
6195                 }
6196
6197                 /*
6198                  * For mcs frames, if mixedmode(overloaded with long preamble) is going to be set,
6199                  * fill in non-zero MModeLen and/or MModeFbrLen
6200                  *  it will be unnecessary if they are separated
6201                  */
6202                 if (IS_MCS(rspec[0]) && (preamble_type[0] == WLC_MM_PREAMBLE)) {
6203                         u16 mmodelen =
6204                             wlc_calc_lsig_len(wlc, rspec[0], phylen);
6205                         txh->MModeLen = htol16(mmodelen);
6206                 }
6207
6208                 if (IS_MCS(rspec[1]) && (preamble_type[1] == WLC_MM_PREAMBLE)) {
6209                         u16 mmodefbrlen =
6210                             wlc_calc_lsig_len(wlc, rspec[1], phylen);
6211                         txh->MModeFbrLen = htol16(mmodefbrlen);
6212                 }
6213         }
6214
6215         if (IS_MCS(rspec[0]))
6216                 ASSERT(IS_MCS(rspec[1]));
6217
6218         ASSERT(!IS_MCS(rspec[0]) ||
6219                ((preamble_type[0] == WLC_MM_PREAMBLE) == (txh->MModeLen != 0)));
6220         ASSERT(!IS_MCS(rspec[1]) ||
6221                ((preamble_type[1] == WLC_MM_PREAMBLE) ==
6222                 (txh->MModeFbrLen != 0)));
6223
6224         ac = wme_fifo2ac[queue];
6225         if (SCB_WME(scb) && qos && wlc->edcf_txop[ac]) {
6226                 uint frag_dur, dur, dur_fallback;
6227
6228                 ASSERT(!ETHER_ISMULTI(&h->a1));
6229
6230                 /* WME: Update TXOP threshold */
6231                 if ((!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) && (frag == 0)) {
6232                         frag_dur =
6233                             wlc_calc_frame_time(wlc, rspec[0], preamble_type[0],
6234                                                 phylen);
6235
6236                         if (rts) {
6237                                 /* 1 RTS or CTS-to-self frame */
6238                                 dur =
6239                                     wlc_calc_cts_time(wlc, rts_rspec[0],
6240                                                       rts_preamble_type[0]);
6241                                 dur_fallback =
6242                                     wlc_calc_cts_time(wlc, rts_rspec[1],
6243                                                       rts_preamble_type[1]);
6244                                 /* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6245                                 dur += ltoh16(rts->durid);
6246                                 dur_fallback += ltoh16(txh->RTSDurFallback);
6247                         } else if (use_rifs) {
6248                                 dur = frag_dur;
6249                                 dur_fallback = 0;
6250                         } else {
6251                                 /* frame + SIFS + ACK */
6252                                 dur = frag_dur;
6253                                 dur +=
6254                                     wlc_compute_frame_dur(wlc, rspec[0],
6255                                                           preamble_type[0], 0);
6256
6257                                 dur_fallback =
6258                                     wlc_calc_frame_time(wlc, rspec[1],
6259                                                         preamble_type[1],
6260                                                         phylen);
6261                                 dur_fallback +=
6262                                     wlc_compute_frame_dur(wlc, rspec[1],
6263                                                           preamble_type[1], 0);
6264                         }
6265                         /* NEED to set TxFesTimeNormal (hard) */
6266                         txh->TxFesTimeNormal = htol16((u16) dur);
6267                         /* NEED to set fallback rate version of TxFesTimeNormal (hard) */
6268                         txh->TxFesTimeFallback = htol16((u16) dur_fallback);
6269
6270                         /* update txop byte threshold (txop minus intraframe overhead) */
6271                         if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6272                                 {
6273                                         uint newfragthresh;
6274
6275                                         newfragthresh =
6276                                             wlc_calc_frame_len(wlc, rspec[0],
6277                                                                preamble_type[0],
6278                                                                (wlc->
6279                                                                 edcf_txop[ac] -
6280                                                                 (dur -
6281                                                                  frag_dur)));
6282                                         /* range bound the fragthreshold */
6283                                         if (newfragthresh < DOT11_MIN_FRAG_LEN)
6284                                                 newfragthresh =
6285                                                     DOT11_MIN_FRAG_LEN;
6286                                         else if (newfragthresh >
6287                                                  wlc->usr_fragthresh)
6288                                                 newfragthresh =
6289                                                     wlc->usr_fragthresh;
6290                                         /* update the fragthresh and do txc update */
6291                                         if (wlc->fragthresh[queue] !=
6292                                             (u16) newfragthresh) {
6293                                                 wlc->fragthresh[queue] =
6294                                                     (u16) newfragthresh;
6295                                         }
6296                                 }
6297                         } else
6298                                 WL_ERROR(("wl%d: %s txop invalid for rate %d\n",
6299                                           wlc->pub->unit, fifo_names[queue],
6300                                           RSPEC2RATE(rspec[0])));
6301
6302                         if (dur > wlc->edcf_txop[ac])
6303                                 WL_ERROR(("wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n", wlc->pub->unit, __func__, fifo_names[queue], phylen, wlc->fragthresh[queue], dur, wlc->edcf_txop[ac]));
6304                 }
6305         }
6306
6307         return 0;
6308 }
6309
6310 void wlc_tbtt(wlc_info_t *wlc, d11regs_t *regs)
6311 {
6312         wlc_bsscfg_t *cfg = wlc->cfg;
6313
6314         WLCNTINCR(wlc->pub->_cnt->tbtt);
6315
6316         if (BSSCFG_STA(cfg)) {
6317                 /* run watchdog here if the watchdog timer is not armed */
6318                 if (WLC_WATCHDOG_TBTT(wlc)) {
6319                         u32 cur, delta;
6320                         if (wlc->WDarmed) {
6321                                 wl_del_timer(wlc->wl, wlc->wdtimer);
6322                                 wlc->WDarmed = false;
6323                         }
6324
6325                         cur = OSL_SYSUPTIME();
6326                         delta = cur > wlc->WDlast ? cur - wlc->WDlast :
6327                             (u32) ~0 - wlc->WDlast + cur + 1;
6328                         if (delta >= TIMER_INTERVAL_WATCHDOG) {
6329                                 wlc_watchdog((void *)wlc);
6330                                 wlc->WDlast = cur;
6331                         }
6332
6333                         wl_add_timer(wlc->wl, wlc->wdtimer,
6334                                      wlc_watchdog_backup_bi(wlc), true);
6335                         wlc->WDarmed = true;
6336                 }
6337         }
6338
6339         if (!cfg->BSS) {
6340                 /* DirFrmQ is now valid...defer setting until end of ATIM window */
6341                 wlc->qvalid |= MCMD_DIRFRMQVAL;
6342         }
6343 }
6344
6345 /* GP timer is a freerunning 32 bit counter, decrements at 1 us rate */
6346 void wlc_hwtimer_gptimer_set(wlc_info_t *wlc, uint us)
6347 {
6348         ASSERT(wlc->pub->corerev >= 3); /* no gptimer in earlier revs */
6349         W_REG(wlc->osh, &wlc->regs->gptimer, us);
6350 }
6351
6352 void wlc_hwtimer_gptimer_abort(wlc_info_t *wlc)
6353 {
6354         ASSERT(wlc->pub->corerev >= 3);
6355         W_REG(wlc->osh, &wlc->regs->gptimer, 0);
6356 }
6357
6358 static void wlc_hwtimer_gptimer_cb(wlc_info_t *wlc)
6359 {
6360         /* when interrupt is generated, the counter is loaded with last value
6361          * written and continue to decrement. So it has to be cleaned first
6362          */
6363         W_REG(wlc->osh, &wlc->regs->gptimer, 0);
6364 }
6365
6366 /*
6367  * This fn has all the high level dpc processing from wlc_dpc.
6368  * POLICY: no macinstatus change, no bounding loop.
6369  *         All dpc bounding should be handled in BMAC dpc, like txstatus and rxint
6370  */
6371 void wlc_high_dpc(wlc_info_t *wlc, u32 macintstatus)
6372 {
6373         d11regs_t *regs = wlc->regs;
6374 #ifdef BCMDBG
6375         char flagstr[128];
6376         static const bcm_bit_desc_t int_flags[] = {
6377                 {MI_MACSSPNDD, "MACSSPNDD"},
6378                 {MI_BCNTPL, "BCNTPL"},
6379                 {MI_TBTT, "TBTT"},
6380                 {MI_BCNSUCCESS, "BCNSUCCESS"},
6381                 {MI_BCNCANCLD, "BCNCANCLD"},
6382                 {MI_ATIMWINEND, "ATIMWINEND"},
6383                 {MI_PMQ, "PMQ"},
6384                 {MI_NSPECGEN_0, "NSPECGEN_0"},
6385                 {MI_NSPECGEN_1, "NSPECGEN_1"},
6386                 {MI_MACTXERR, "MACTXERR"},
6387                 {MI_NSPECGEN_3, "NSPECGEN_3"},
6388                 {MI_PHYTXERR, "PHYTXERR"},
6389                 {MI_PME, "PME"},
6390                 {MI_GP0, "GP0"},
6391                 {MI_GP1, "GP1"},
6392                 {MI_DMAINT, "DMAINT"},
6393                 {MI_TXSTOP, "TXSTOP"},
6394                 {MI_CCA, "CCA"},
6395                 {MI_BG_NOISE, "BG_NOISE"},
6396                 {MI_DTIM_TBTT, "DTIM_TBTT"},
6397                 {MI_PRQ, "PRQ"},
6398                 {MI_PWRUP, "PWRUP"},
6399                 {MI_RFDISABLE, "RFDISABLE"},
6400                 {MI_TFS, "TFS"},
6401                 {MI_PHYCHANGED, "PHYCHANGED"},
6402                 {MI_TO, "TO"},
6403                 {0, NULL}
6404         };
6405
6406         if (macintstatus & ~(MI_TBTT | MI_TXSTOP)) {
6407                 bcm_format_flags(int_flags, macintstatus, flagstr,
6408                                  sizeof(flagstr));
6409                 WL_TRACE(("wl%d: macintstatus 0x%x %s\n", wlc->pub->unit,
6410                           macintstatus, flagstr));
6411         }
6412 #endif                          /* BCMDBG */
6413
6414         if (macintstatus & MI_PRQ) {
6415                 /* Process probe request FIFO */
6416                 ASSERT(0 && "PRQ Interrupt in non-MBSS");
6417         }
6418
6419         /* TBTT indication */
6420         /* ucode only gives either TBTT or DTIM_TBTT, not both */
6421         if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
6422                 wlc_tbtt(wlc, regs);
6423
6424         if (macintstatus & MI_GP0) {
6425                 WL_ERROR(("wl%d: PSM microcode watchdog fired at %d (seconds). Resetting.\n", wlc->pub->unit, wlc->pub->now));
6426
6427                 printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
6428                             __func__, CHIPID(wlc->pub->sih->chip),
6429                             CHIPREV(wlc->pub->sih->chiprev));
6430
6431                 WLCNTINCR(wlc->pub->_cnt->psmwds);
6432
6433                 /* big hammer */
6434                 wl_init(wlc->wl);
6435         }
6436
6437         /* gptimer timeout */
6438         if (macintstatus & MI_TO) {
6439                 wlc_hwtimer_gptimer_cb(wlc);
6440         }
6441
6442         if (macintstatus & MI_RFDISABLE) {
6443                 WL_ERROR(("wl%d: MAC Detected a change on the RF Disable Input 0x%x\n", wlc->pub->unit, R_REG(wlc->osh, &regs->phydebug) & PDBG_RFD));
6444                 /* delay the cleanup to wl_down in IBSS case */
6445                 if ((R_REG(wlc->osh, &regs->phydebug) & PDBG_RFD)) {
6446                         int idx;
6447                         wlc_bsscfg_t *bsscfg;
6448                         FOREACH_BSS(wlc, idx, bsscfg) {
6449                                 if (!BSSCFG_STA(bsscfg) || !bsscfg->enable
6450                                     || !bsscfg->BSS)
6451                                         continue;
6452                                 WL_ERROR(("wl%d: wlc_dpc: rfdisable -> wlc_bsscfg_disable()\n", wlc->pub->unit));
6453                         }
6454                 }
6455         }
6456
6457         /* send any enq'd tx packets. Just makes sure to jump start tx */
6458         if (!pktq_empty(&wlc->active_queue->q))
6459                 wlc_send_q(wlc, wlc->active_queue);
6460
6461         ASSERT(wlc_ps_check(wlc));
6462 }
6463
6464 static void *wlc_15420war(wlc_info_t *wlc, uint queue)
6465 {
6466         hnddma_t *di;
6467         void *p;
6468
6469         ASSERT(queue < NFIFO);
6470
6471         if ((D11REV_IS(wlc->pub->corerev, 4))
6472             || (D11REV_GT(wlc->pub->corerev, 6)))
6473                 return NULL;
6474
6475         di = wlc->hw->di[queue];
6476         ASSERT(di != NULL);
6477
6478         /* get next packet, ignoring XmtStatus.Curr */
6479         p = dma_getnexttxp(di, HNDDMA_RANGE_ALL);
6480
6481         /* sw block tx dma */
6482         dma_txblock(di);
6483
6484         /* if tx ring is now empty, reset and re-init the tx dma channel */
6485         if (dma_txactive(wlc->hw->di[queue]) == 0) {
6486                 WLCNTINCR(wlc->pub->_cnt->txdmawar);
6487                 if (!dma_txreset(di))
6488                         WL_ERROR(("wl%d: %s: dma_txreset[%d]: cannot stop dma\n", wlc->pub->unit, __func__, queue));
6489                 dma_txinit(di);
6490         }
6491         return p;
6492 }
6493
6494 static void wlc_war16165(wlc_info_t *wlc, bool tx)
6495 {
6496         if (tx) {
6497                 /* the post-increment is used in STAY_AWAKE macro */
6498                 if (wlc->txpend16165war++ == 0)
6499                         wlc_set_ps_ctrl(wlc);
6500         } else {
6501                 wlc->txpend16165war--;
6502                 if (wlc->txpend16165war == 0)
6503                         wlc_set_ps_ctrl(wlc);
6504         }
6505 }
6506
6507 /* process an individual tx_status_t */
6508 /* WLC_HIGH_API */
6509 bool BCMFASTPATH
6510 wlc_dotxstatus(wlc_info_t *wlc, tx_status_t *txs, u32 frm_tx2)
6511 {
6512         struct sk_buff *p;
6513         uint queue;
6514         d11txh_t *txh;
6515         struct scb *scb = NULL;
6516         bool free_pdu;
6517         struct osl_info *osh;
6518         int tx_rts, tx_frame_count, tx_rts_count;
6519         uint totlen, supr_status;
6520         bool lastframe;
6521         struct dot11_header *h;
6522         u16 fc;
6523         u16 mcl;
6524         struct ieee80211_tx_info *tx_info;
6525         struct ieee80211_tx_rate *txrate;
6526         int i;
6527
6528         (void)(frm_tx2);        /* Compiler reference to avoid unused variable warning */
6529
6530         /* discard intermediate indications for ucode with one legitimate case:
6531          *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange, but the subsequent
6532          *   tx of DATA failed. so it will start rts/cts from the beginning (resetting the rts
6533          *   transmission count)
6534          */
6535         if (!(txs->status & TX_STATUS_AMPDU)
6536             && (txs->status & TX_STATUS_INTERMEDIATE)) {
6537                 WLCNTADD(wlc->pub->_cnt->txnoack,
6538                          ((txs->
6539                            status & TX_STATUS_FRM_RTX_MASK) >>
6540                           TX_STATUS_FRM_RTX_SHIFT));
6541                 WL_ERROR(("%s: INTERMEDIATE but not AMPDU\n", __func__));
6542                 return false;
6543         }
6544
6545         osh = wlc->osh;
6546         queue = txs->frameid & TXFID_QUEUE_MASK;
6547         ASSERT(queue < NFIFO);
6548         if (queue >= NFIFO) {
6549                 p = NULL;
6550                 goto fatal;
6551         }
6552
6553         p = GETNEXTTXP(wlc, queue);
6554         if (WLC_WAR16165(wlc))
6555                 wlc_war16165(wlc, false);
6556         if (p == NULL)
6557                 p = wlc_15420war(wlc, queue);
6558         ASSERT(p != NULL);
6559         if (p == NULL)
6560                 goto fatal;
6561
6562         txh = (d11txh_t *) (p->data);
6563         mcl = ltoh16(txh->MacTxControlLow);
6564
6565         if (txs->phyerr) {
6566                 WL_ERROR(("phyerr 0x%x, rate 0x%x\n", txs->phyerr,
6567                           txh->MainRates));
6568                 wlc_print_txdesc(txh);
6569                 wlc_print_txstatus(txs);
6570         }
6571
6572         ASSERT(txs->frameid == htol16(txh->TxFrameID));
6573         if (txs->frameid != htol16(txh->TxFrameID))
6574                 goto fatal;
6575
6576         tx_info = IEEE80211_SKB_CB(p);
6577         h = (struct dot11_header *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
6578         fc = ltoh16(h->fc);
6579
6580         scb = (struct scb *)tx_info->control.sta->drv_priv;
6581
6582         if (N_ENAB(wlc->pub)) {
6583                 u8 *plcp = (u8 *) (txh + 1);
6584                 if (PLCP3_ISSGI(plcp[3]))
6585                         WLCNTINCR(wlc->pub->_cnt->txmpdu_sgi);
6586                 if (PLCP3_ISSTBC(plcp[3]))
6587                         WLCNTINCR(wlc->pub->_cnt->txmpdu_stbc);
6588         }
6589
6590         if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
6591                 ASSERT((mcl & TXC_AMPDU_MASK) != TXC_AMPDU_NONE);
6592                 wlc_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
6593                 return false;
6594         }
6595
6596         supr_status = txs->status & TX_STATUS_SUPR_MASK;
6597         if (supr_status == TX_STATUS_SUPR_BADCH)
6598                 WL_NONE(("%s: Pkt tx suppressed, possibly channel %d\n",
6599                          __func__, CHSPEC_CHANNEL(wlc->default_bss->chanspec)));
6600
6601         tx_rts = htol16(txh->MacTxControlLow) & TXC_SENDRTS;
6602         tx_frame_count =
6603             (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
6604         tx_rts_count =
6605             (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
6606
6607         lastframe = (fc & FC_MOREFRAG) == 0;
6608
6609         if (!lastframe) {
6610                 WL_ERROR(("Not last frame!\n"));
6611         } else {
6612                 u16 sfbl, lfbl;
6613                 ieee80211_tx_info_clear_status(tx_info);
6614                 if (queue < AC_COUNT) {
6615                         sfbl = WLC_WME_RETRY_SFB_GET(wlc, wme_fifo2ac[queue]);
6616                         lfbl = WLC_WME_RETRY_LFB_GET(wlc, wme_fifo2ac[queue]);
6617                 } else {
6618                         sfbl = wlc->SFBL;
6619                         lfbl = wlc->LFBL;
6620                 }
6621
6622                 txrate = tx_info->status.rates;
6623                 /* FIXME: this should use a combination of sfbl, lfbl depending on frame length and RTS setting */
6624                 if ((tx_frame_count > sfbl) && (txrate[1].idx >= 0)) {
6625                         /* rate selection requested a fallback rate and we used it */
6626                         txrate->count = lfbl;
6627                         txrate[1].count = tx_frame_count - lfbl;
6628                 } else {
6629                         /* rate selection did not request fallback rate, or we didn't need it */
6630                         txrate->count = tx_frame_count;
6631                         /* rc80211_minstrel.c:minstrel_tx_status() expects unused rates to be marked with idx = -1 */
6632                         txrate[1].idx = -1;
6633                         txrate[1].count = 0;
6634                 }
6635
6636                 /* clear the rest of the rates */
6637                 for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
6638                         txrate[i].idx = -1;
6639                         txrate[i].count = 0;
6640                 }
6641
6642                 if (txs->status & TX_STATUS_ACK_RCV)
6643                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
6644         }
6645
6646         totlen = pkttotlen(osh, p);
6647         free_pdu = true;
6648
6649         wlc_txfifo_complete(wlc, queue, 1);
6650
6651         if (lastframe) {
6652                 p->next = NULL;
6653                 p->prev = NULL;
6654                 wlc->txretried = 0;
6655                 /* remove PLCP & Broadcom tx descriptor header */
6656                 skb_pull(p, D11_PHY_HDR_LEN);
6657                 skb_pull(p, D11_TXH_LEN);
6658                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
6659                 WLCNTINCR(wlc->pub->_cnt->ieee_tx_status);
6660         } else {
6661                 WL_ERROR(("%s: Not last frame => not calling tx_status\n",
6662                           __func__));
6663         }
6664
6665         return false;
6666
6667  fatal:
6668         ASSERT(0);
6669         if (p)
6670                 PKTFREE(osh, p, true);
6671
6672         return true;
6673
6674 }
6675
6676 void BCMFASTPATH
6677 wlc_txfifo_complete(wlc_info_t *wlc, uint fifo, s8 txpktpend)
6678 {
6679         TXPKTPENDDEC(wlc, fifo, txpktpend);
6680         WL_TRACE(("wlc_txfifo_complete, pktpend dec %d to %d\n", txpktpend,
6681                   TXPKTPENDGET(wlc, fifo)));
6682
6683         /* There is more room; mark precedences related to this FIFO sendable */
6684         WLC_TX_FIFO_ENAB(wlc, fifo);
6685         ASSERT(TXPKTPENDGET(wlc, fifo) >= 0);
6686
6687         if (!TXPKTPENDTOT(wlc)) {
6688                 if (wlc->block_datafifo & DATA_BLOCK_TX_SUPR)
6689                         wlc_bsscfg_tx_check(wlc);
6690         }
6691
6692         /* Clear MHF2_TXBCMC_NOW flag if BCMC fifo has drained */
6693         if (AP_ENAB(wlc->pub) &&
6694             wlc->bcmcfifo_drain && !TXPKTPENDGET(wlc, TX_BCMC_FIFO)) {
6695                 wlc->bcmcfifo_drain = false;
6696                 wlc_mhf(wlc, MHF2, MHF2_TXBCMC_NOW, 0, WLC_BAND_AUTO);
6697         }
6698
6699         /* figure out which bsscfg is being worked on... */
6700 }
6701
6702 /* Given the beacon interval in kus, and a 64 bit TSF in us,
6703  * return the offset (in us) of the TSF from the last TBTT
6704  */
6705 u32 wlc_calc_tbtt_offset(u32 bp, u32 tsf_h, u32 tsf_l)
6706 {
6707         u32 k, btklo, btkhi, offset;
6708
6709         /* TBTT is always an even multiple of the beacon_interval,
6710          * so the TBTT less than or equal to the beacon timestamp is
6711          * the beacon timestamp minus the beacon timestamp modulo
6712          * the beacon interval.
6713          *
6714          * TBTT = BT - (BT % BIu)
6715          *      = (BTk - (BTk % BP)) * 2^10
6716          *
6717          * BT = beacon timestamp (usec, 64bits)
6718          * BTk = beacon timestamp (Kusec, 54bits)
6719          * BP = beacon interval (Kusec, 16bits)
6720          * BIu = BP * 2^10 = beacon interval (usec, 26bits)
6721          *
6722          * To keep the calculations in u32s, the modulo operation
6723          * on the high part of BT needs to be done in parts using the
6724          * relations:
6725          * X*Y mod Z = ((X mod Z) * (Y mod Z)) mod Z
6726          * and
6727          * (X + Y) mod Z = ((X mod Z) + (Y mod Z)) mod Z
6728          *
6729          * So, if BTk[n] = u16 n [0,3] of BTk.
6730          * BTk % BP = SUM((BTk[n] * 2^16n) % BP , 0<=n<4) % BP
6731          * and the SUM term can be broken down:
6732          * (BTk[n] *     2^16n)    % BP
6733          * (BTk[n] * (2^16n % BP)) % BP
6734          *
6735          * Create a set of power of 2 mod BP constants:
6736          * K[n] = 2^(16n) % BP
6737          *      = (K[n-1] * 2^16) % BP
6738          * K[2] = 2^32 % BP = ((2^16 % BP) * 2^16) % BP
6739          *
6740          * BTk % BP = BTk[0-1] % BP +
6741          *            (BTk[2] * K[2]) % BP +
6742          *            (BTk[3] * K[3]) % BP
6743          *
6744          * Since K[n] < 2^16 and BTk[n] is < 2^16, then BTk[n] * K[n] < 2^32
6745          */
6746
6747         /* BTk = BT >> 10, btklo = BTk[0-3], bkthi = BTk[4-6] */
6748         btklo = (tsf_h << 22) | (tsf_l >> 10);
6749         btkhi = tsf_h >> 10;
6750
6751         /* offset = BTk % BP */
6752         offset = btklo % bp;
6753
6754         /* K[2] = ((2^16 % BP) * 2^16) % BP */
6755         k = (u32) (1 << 16) % bp;
6756         k = (u32) (k * 1 << 16) % (u32) bp;
6757
6758         /* offset += (BTk[2] * K[2]) % BP */
6759         offset += ((btkhi & 0xffff) * k) % bp;
6760
6761         /* BTk[3] */
6762         btkhi = btkhi >> 16;
6763
6764         /* k[3] = (K[2] * 2^16) % BP */
6765         k = (k << 16) % bp;
6766
6767         /* offset += (BTk[3] * K[3]) % BP */
6768         offset += ((btkhi & 0xffff) * k) % bp;
6769
6770         offset = offset % bp;
6771
6772         /* convert offset from kus to us by shifting up 10 bits and
6773          * add in the low 10 bits of tsf that we ignored
6774          */
6775         offset = (offset << 10) + (tsf_l & 0x3FF);
6776
6777         return offset;
6778 }
6779
6780 /* Update beacon listen interval in shared memory */
6781 void wlc_bcn_li_upd(wlc_info_t *wlc)
6782 {
6783         if (AP_ENAB(wlc->pub))
6784                 return;
6785
6786         /* wake up every DTIM is the default */
6787         if (wlc->bcn_li_dtim == 1)
6788                 wlc_write_shm(wlc, M_BCN_LI, 0);
6789         else
6790                 wlc_write_shm(wlc, M_BCN_LI,
6791                               (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
6792 }
6793
6794 static void
6795 prep_mac80211_status(wlc_info_t *wlc, d11rxhdr_t *rxh, struct sk_buff *p,
6796                      struct ieee80211_rx_status *rx_status)
6797 {
6798         u32 tsf_l, tsf_h;
6799         wlc_d11rxhdr_t *wlc_rxh = (wlc_d11rxhdr_t *) rxh;
6800         int preamble;
6801         int channel;
6802         ratespec_t rspec;
6803         unsigned char *plcp;
6804
6805         wlc_read_tsf(wlc, &tsf_l, &tsf_h);      /* mactime */
6806         rx_status->mactime = tsf_h;
6807         rx_status->mactime <<= 32;
6808         rx_status->mactime |= tsf_l;
6809         rx_status->flag |= RX_FLAG_TSFT;
6810
6811         channel = WLC_CHAN_CHANNEL(rxh->RxChan);
6812
6813         /* XXX  Channel/badn needs to be filtered against whether we are single/dual band card */
6814         if (channel > 14) {
6815                 rx_status->band = IEEE80211_BAND_5GHZ;
6816                 rx_status->freq = wf_channel2mhz(channel, WF_CHAN_FACTOR_5_G);
6817         } else {
6818                 rx_status->band = IEEE80211_BAND_2GHZ;
6819                 rx_status->freq = wf_channel2mhz(channel, WF_CHAN_FACTOR_2_4_G);
6820         }
6821
6822         rx_status->signal = wlc_rxh->rssi;      /* signal */
6823
6824         /* noise */
6825         /* qual */
6826         rx_status->antenna = (rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;      /* ant */
6827
6828         plcp = p->data;
6829
6830         rspec = wlc_compute_rspec(rxh, plcp);
6831         if (IS_MCS(rspec)) {
6832                 rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
6833                 rx_status->flag |= RX_FLAG_HT;
6834                 if (RSPEC_IS40MHZ(rspec))
6835                         rx_status->flag |= RX_FLAG_40MHZ;
6836         } else {
6837                 switch (RSPEC2RATE(rspec)) {
6838                 case WLC_RATE_1M:
6839                         rx_status->rate_idx = 0;
6840                         break;
6841                 case WLC_RATE_2M:
6842                         rx_status->rate_idx = 1;
6843                         break;
6844                 case WLC_RATE_5M5:
6845                         rx_status->rate_idx = 2;
6846                         break;
6847                 case WLC_RATE_11M:
6848                         rx_status->rate_idx = 3;
6849                         break;
6850                 case WLC_RATE_6M:
6851                         rx_status->rate_idx = 4;
6852                         break;
6853                 case WLC_RATE_9M:
6854                         rx_status->rate_idx = 5;
6855                         break;
6856                 case WLC_RATE_12M:
6857                         rx_status->rate_idx = 6;
6858                         break;
6859                 case WLC_RATE_18M:
6860                         rx_status->rate_idx = 7;
6861                         break;
6862                 case WLC_RATE_24M:
6863                         rx_status->rate_idx = 8;
6864                         break;
6865                 case WLC_RATE_36M:
6866                         rx_status->rate_idx = 9;
6867                         break;
6868                 case WLC_RATE_48M:
6869                         rx_status->rate_idx = 10;
6870                         break;
6871                 case WLC_RATE_54M:
6872                         rx_status->rate_idx = 11;
6873                         break;
6874                 default:
6875                         WL_ERROR(("%s: Unknown rate\n", __func__));
6876                 }
6877
6878                 /* Determine short preamble and rate_idx */
6879                 preamble = 0;
6880                 if (IS_CCK(rspec)) {
6881                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
6882                                 WL_ERROR(("Short CCK\n"));
6883                         rx_status->flag |= RX_FLAG_SHORTPRE;
6884                 } else if (IS_OFDM(rspec)) {
6885                         rx_status->flag |= RX_FLAG_SHORTPRE;
6886                 } else {
6887                         WL_ERROR(("%s: Unknown modulation\n", __func__));
6888                 }
6889         }
6890
6891         if (PLCP3_ISSGI(plcp[3]))
6892                 rx_status->flag |= RX_FLAG_SHORT_GI;
6893
6894         if (rxh->RxStatus1 & RXS_DECERR) {
6895                 rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
6896                 WL_ERROR(("%s:  RX_FLAG_FAILED_PLCP_CRC\n", __func__));
6897         }
6898         if (rxh->RxStatus1 & RXS_FCSERR) {
6899                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
6900                 WL_ERROR(("%s:  RX_FLAG_FAILED_FCS_CRC\n", __func__));
6901         }
6902 }
6903
6904 static void
6905 wlc_recvctl(wlc_info_t *wlc, struct osl_info *osh, d11rxhdr_t *rxh,
6906             struct sk_buff *p)
6907 {
6908         int len_mpdu;
6909         struct ieee80211_rx_status rx_status;
6910 #if defined(BCMDBG)
6911         struct sk_buff *skb = p;
6912 #endif                          /* BCMDBG */
6913         /* Todo:
6914          * Cache plcp for first MPDU of AMPD and use chacched version for INTERMEDIATE.
6915          * Test for INTERMEDIATE  like so:
6916          * if (!(plcp[0] | plcp[1] | plcp[2]))
6917          */
6918
6919         memset(&rx_status, 0, sizeof(rx_status));
6920         prep_mac80211_status(wlc, rxh, p, &rx_status);
6921
6922         /* mac header+body length, exclude CRC and plcp header */
6923         len_mpdu = p->len - D11_PHY_HDR_LEN - DOT11_FCS_LEN;
6924         skb_pull(p, D11_PHY_HDR_LEN);
6925         __skb_trim(p, len_mpdu);
6926
6927         ASSERT(!(p->next));
6928         ASSERT(!(p->prev));
6929
6930         ASSERT(IS_ALIGNED((unsigned long)skb->data, 2));
6931
6932         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
6933         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
6934
6935         WLCNTINCR(wlc->pub->_cnt->ieee_rx);
6936         PKTUNALLOC(osh);
6937         return;
6938 }
6939
6940 void wlc_bss_list_free(wlc_info_t *wlc, wlc_bss_list_t *bss_list)
6941 {
6942         uint index;
6943         wlc_bss_info_t *bi;
6944
6945         if (!bss_list) {
6946                 WL_ERROR(("%s: Attempting to free NULL list\n", __func__));
6947                 return;
6948         }
6949         /* inspect all BSS descriptor */
6950         for (index = 0; index < bss_list->count; index++) {
6951                 bi = bss_list->ptrs[index];
6952                 if (bi) {
6953                         if (bi->bcn_prb) {
6954                                 kfree(bi->bcn_prb);
6955                         }
6956                         kfree(bi);
6957                         bss_list->ptrs[index] = NULL;
6958                 }
6959         }
6960         bss_list->count = 0;
6961 }
6962
6963 /* Process received frames */
6964 /*
6965  * Return true if more frames need to be processed. false otherwise.
6966  * Param 'bound' indicates max. # frames to process before break out.
6967  */
6968 /* WLC_HIGH_API */
6969 void BCMFASTPATH wlc_recv(wlc_info_t *wlc, struct sk_buff *p)
6970 {
6971         d11rxhdr_t *rxh;
6972         struct dot11_header *h;
6973         struct osl_info *osh;
6974         u16 fc;
6975         uint len;
6976         bool is_amsdu;
6977
6978         WL_TRACE(("wl%d: wlc_recv\n", wlc->pub->unit));
6979
6980         osh = wlc->osh;
6981
6982         /* frame starts with rxhdr */
6983         rxh = (d11rxhdr_t *) (p->data);
6984
6985         /* strip off rxhdr */
6986         skb_pull(p, wlc->hwrxoff);
6987
6988         /* fixup rx header endianness */
6989         ltoh16_buf((void *)rxh, sizeof(d11rxhdr_t));
6990
6991         /* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
6992         if (rxh->RxStatus1 & RXS_PBPRES) {
6993                 if (p->len < 2) {
6994                         WLCNTINCR(wlc->pub->_cnt->rxrunt);
6995                         WL_ERROR(("wl%d: wlc_recv: rcvd runt of len %d\n",
6996                                   wlc->pub->unit, p->len));
6997                         goto toss;
6998                 }
6999                 skb_pull(p, 2);
7000         }
7001
7002         h = (struct dot11_header *)(p->data + D11_PHY_HDR_LEN);
7003         len = p->len;
7004
7005         if (rxh->RxStatus1 & RXS_FCSERR) {
7006                 if (wlc->pub->mac80211_state & MAC80211_PROMISC_BCNS) {
7007                         WL_ERROR(("FCSERR while scanning******* - tossing\n"));
7008                         goto toss;
7009                 } else {
7010                         WL_ERROR(("RCSERR!!!\n"));
7011                         goto toss;
7012                 }
7013         }
7014
7015         /* check received pkt has at least frame control field */
7016         if (len >= D11_PHY_HDR_LEN + sizeof(h->fc)) {
7017                 fc = ltoh16(h->fc);
7018         } else {
7019                 WLCNTINCR(wlc->pub->_cnt->rxrunt);
7020                 goto toss;
7021         }
7022
7023         is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7024
7025         /* explicitly test bad src address to avoid sending bad deauth */
7026         if (!is_amsdu) {
7027                 /* CTS and ACK CTL frames are w/o a2 */
7028                 if (FC_TYPE(fc) == FC_TYPE_DATA || FC_TYPE(fc) == FC_TYPE_MNG) {
7029                         if ((ETHER_ISNULLADDR(&h->a2) || ETHER_ISMULTI(&h->a2))) {
7030                                 WL_ERROR(("wl%d: %s: dropping a frame with "
7031                                         "invalid src mac address, a2: %pM\n",
7032                                         wlc->pub->unit, __func__, &h->a2));
7033                                 WLCNTINCR(wlc->pub->_cnt->rxbadsrcmac);
7034                                 goto toss;
7035                         }
7036                         WLCNTINCR(wlc->pub->_cnt->rxfrag);
7037                 }
7038         }
7039
7040         /* due to sheer numbers, toss out probe reqs for now */
7041         if (FC_TYPE(fc) == FC_TYPE_MNG) {
7042                 if ((fc & FC_KIND_MASK) == FC_PROBE_REQ)
7043                         goto toss;
7044         }
7045
7046         if (is_amsdu) {
7047                 WL_ERROR(("%s: is_amsdu causing toss\n", __func__));
7048                 goto toss;
7049         }
7050
7051         wlc_recvctl(wlc, osh, rxh, p);
7052         return;
7053
7054  toss:
7055         PKTFREE(osh, p, false);
7056 }
7057
7058 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7059  * number of bytes goes in the length field
7060  *
7061  * Formula given by HT PHY Spec v 1.13
7062  *   len = 3(nsyms + nstream + 3) - 3
7063  */
7064 u16 BCMFASTPATH
7065 wlc_calc_lsig_len(wlc_info_t *wlc, ratespec_t ratespec, uint mac_len)
7066 {
7067         uint nsyms, len = 0, kNdps;
7068
7069         WL_TRACE(("wl%d: wlc_calc_lsig_len: rate %d, len%d\n", wlc->pub->unit,
7070                   RSPEC2RATE(ratespec), mac_len));
7071
7072         if (IS_MCS(ratespec)) {
7073                 uint mcs = ratespec & RSPEC_RATE_MASK;
7074                 /* MCS_TXS(mcs) returns num tx streams - 1 */
7075                 int tot_streams = (MCS_TXS(mcs) + 1) + RSPEC_STC(ratespec);
7076
7077                 ASSERT(WLC_PHY_11N_CAP(wlc->band));
7078                 /* the payload duration calculation matches that of regular ofdm */
7079                 /* 1000Ndbps = kbps * 4 */
7080                 kNdps =
7081                     MCS_RATE(mcs, RSPEC_IS40MHZ(ratespec),
7082                              RSPEC_ISSGI(ratespec)) * 4;
7083
7084                 if (RSPEC_STC(ratespec) == 0)
7085                         /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
7086                         nsyms =
7087                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7088                                   APHY_TAIL_NBITS) * 1000, kNdps);
7089                 else
7090                         /* STBC needs to have even number of symbols */
7091                         nsyms =
7092                             2 *
7093                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7094                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7095
7096                 nsyms += (tot_streams + 3);     /* (+3) account for HT-SIG(2) and HT-STF(1) */
7097                 /* 3 bytes/symbol @ legacy 6Mbps rate */
7098                 len = (3 * nsyms) - 3;  /* (-3) excluding service bits and tail bits */
7099         }
7100
7101         return (u16) len;
7102 }
7103
7104 /* calculate frame duration of a given rate and length, return time in usec unit */
7105 uint BCMFASTPATH
7106 wlc_calc_frame_time(wlc_info_t *wlc, ratespec_t ratespec, u8 preamble_type,
7107                     uint mac_len)
7108 {
7109         uint nsyms, dur = 0, Ndps, kNdps;
7110         uint rate = RSPEC2RATE(ratespec);
7111
7112         if (rate == 0) {
7113                 ASSERT(0);
7114                 WL_ERROR(("wl%d: WAR: using rate of 1 mbps\n", wlc->pub->unit));
7115                 rate = WLC_RATE_1M;
7116         }
7117
7118         WL_TRACE(("wl%d: wlc_calc_frame_time: rspec 0x%x, preamble_type %d, len%d\n", wlc->pub->unit, ratespec, preamble_type, mac_len));
7119
7120         if (IS_MCS(ratespec)) {
7121                 uint mcs = ratespec & RSPEC_RATE_MASK;
7122                 int tot_streams = MCS_TXS(mcs) + RSPEC_STC(ratespec);
7123                 ASSERT(WLC_PHY_11N_CAP(wlc->band));
7124                 ASSERT(WLC_IS_MIMO_PREAMBLE(preamble_type));
7125
7126                 dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
7127                 if (preamble_type == WLC_MM_PREAMBLE)
7128                         dur += PREN_MM_EXT;
7129                 /* 1000Ndbps = kbps * 4 */
7130                 kNdps =
7131                     MCS_RATE(mcs, RSPEC_IS40MHZ(ratespec),
7132                              RSPEC_ISSGI(ratespec)) * 4;
7133
7134                 if (RSPEC_STC(ratespec) == 0)
7135                         /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
7136                         nsyms =
7137                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7138                                   APHY_TAIL_NBITS) * 1000, kNdps);
7139                 else
7140                         /* STBC needs to have even number of symbols */
7141                         nsyms =
7142                             2 *
7143                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7144                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7145
7146                 dur += APHY_SYMBOL_TIME * nsyms;
7147                 if (BAND_2G(wlc->band->bandtype))
7148                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
7149         } else if (IS_OFDM(rate)) {
7150                 dur = APHY_PREAMBLE_TIME;
7151                 dur += APHY_SIGNAL_TIME;
7152                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
7153                 Ndps = rate * 2;
7154                 /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
7155                 nsyms =
7156                     CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
7157                          Ndps);
7158                 dur += APHY_SYMBOL_TIME * nsyms;
7159                 if (BAND_2G(wlc->band->bandtype))
7160                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
7161         } else {
7162                 /* calc # bits * 2 so factor of 2 in rate (1/2 mbps) will divide out */
7163                 mac_len = mac_len * 8 * 2;
7164                 /* calc ceiling of bits/rate = microseconds of air time */
7165                 dur = (mac_len + rate - 1) / rate;
7166                 if (preamble_type & WLC_SHORT_PREAMBLE)
7167                         dur += BPHY_PLCP_SHORT_TIME;
7168                 else
7169                         dur += BPHY_PLCP_TIME;
7170         }
7171         return dur;
7172 }
7173
7174 /* The opposite of wlc_calc_frame_time */
7175 static uint
7176 wlc_calc_frame_len(wlc_info_t *wlc, ratespec_t ratespec, u8 preamble_type,
7177                    uint dur)
7178 {
7179         uint nsyms, mac_len, Ndps, kNdps;
7180         uint rate = RSPEC2RATE(ratespec);
7181
7182         WL_TRACE(("wl%d: wlc_calc_frame_len: rspec 0x%x, preamble_type %d, dur %d\n", wlc->pub->unit, ratespec, preamble_type, dur));
7183
7184         if (IS_MCS(ratespec)) {
7185                 uint mcs = ratespec & RSPEC_RATE_MASK;
7186                 int tot_streams = MCS_TXS(mcs) + RSPEC_STC(ratespec);
7187                 ASSERT(WLC_PHY_11N_CAP(wlc->band));
7188                 dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
7189                 /* payload calculation matches that of regular ofdm */
7190                 if (BAND_2G(wlc->band->bandtype))
7191                         dur -= DOT11_OFDM_SIGNAL_EXTENSION;
7192                 /* kNdbps = kbps * 4 */
7193                 kNdps =
7194                     MCS_RATE(mcs, RSPEC_IS40MHZ(ratespec),
7195                              RSPEC_ISSGI(ratespec)) * 4;
7196                 nsyms = dur / APHY_SYMBOL_TIME;
7197                 mac_len =
7198                     ((nsyms * kNdps) -
7199                      ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
7200         } else if (IS_OFDM(ratespec)) {
7201                 dur -= APHY_PREAMBLE_TIME;
7202                 dur -= APHY_SIGNAL_TIME;
7203                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
7204                 Ndps = rate * 2;
7205                 nsyms = dur / APHY_SYMBOL_TIME;
7206                 mac_len =
7207                     ((nsyms * Ndps) -
7208                      (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
7209         } else {
7210                 if (preamble_type & WLC_SHORT_PREAMBLE)
7211                         dur -= BPHY_PLCP_SHORT_TIME;
7212                 else
7213                         dur -= BPHY_PLCP_TIME;
7214                 mac_len = dur * rate;
7215                 /* divide out factor of 2 in rate (1/2 mbps) */
7216                 mac_len = mac_len / 8 / 2;
7217         }
7218         return mac_len;
7219 }
7220
7221 static uint
7222 wlc_calc_ba_time(wlc_info_t *wlc, ratespec_t rspec, u8 preamble_type)
7223 {
7224         WL_TRACE(("wl%d: wlc_calc_ba_time: rspec 0x%x, preamble_type %d\n",
7225                   wlc->pub->unit, rspec, preamble_type));
7226         /* Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that is less than
7227          * or equal to the rate of the immediately previous frame in the FES
7228          */
7229         rspec = WLC_BASIC_RATE(wlc, rspec);
7230         ASSERT(VALID_RATE_DBG(wlc, rspec));
7231
7232         /* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
7233         return wlc_calc_frame_time(wlc, rspec, preamble_type,
7234                                    (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
7235                                     DOT11_FCS_LEN));
7236 }
7237
7238 static uint BCMFASTPATH
7239 wlc_calc_ack_time(wlc_info_t *wlc, ratespec_t rspec, u8 preamble_type)
7240 {
7241         uint dur = 0;
7242
7243         WL_TRACE(("wl%d: wlc_calc_ack_time: rspec 0x%x, preamble_type %d\n",
7244                   wlc->pub->unit, rspec, preamble_type));
7245         /* Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that is less than
7246          * or equal to the rate of the immediately previous frame in the FES
7247          */
7248         rspec = WLC_BASIC_RATE(wlc, rspec);
7249         ASSERT(VALID_RATE_DBG(wlc, rspec));
7250
7251         /* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
7252         dur =
7253             wlc_calc_frame_time(wlc, rspec, preamble_type,
7254                                 (DOT11_ACK_LEN + DOT11_FCS_LEN));
7255         return dur;
7256 }
7257
7258 static uint
7259 wlc_calc_cts_time(wlc_info_t *wlc, ratespec_t rspec, u8 preamble_type)
7260 {
7261         WL_TRACE(("wl%d: wlc_calc_cts_time: ratespec 0x%x, preamble_type %d\n",
7262                   wlc->pub->unit, rspec, preamble_type));
7263         return wlc_calc_ack_time(wlc, rspec, preamble_type);
7264 }
7265
7266 /* derive wlc->band->basic_rate[] table from 'rateset' */
7267 void wlc_rate_lookup_init(wlc_info_t *wlc, wlc_rateset_t *rateset)
7268 {
7269         u8 rate;
7270         u8 mandatory;
7271         u8 cck_basic = 0;
7272         u8 ofdm_basic = 0;
7273         u8 *br = wlc->band->basic_rate;
7274         uint i;
7275
7276         /* incoming rates are in 500kbps units as in 802.11 Supported Rates */
7277         bzero(br, WLC_MAXRATE + 1);
7278
7279         /* For each basic rate in the rates list, make an entry in the
7280          * best basic lookup.
7281          */
7282         for (i = 0; i < rateset->count; i++) {
7283                 /* only make an entry for a basic rate */
7284                 if (!(rateset->rates[i] & WLC_RATE_FLAG))
7285                         continue;
7286
7287                 /* mask off basic bit */
7288                 rate = (rateset->rates[i] & RATE_MASK);
7289
7290                 if (rate > WLC_MAXRATE) {
7291                         WL_ERROR(("wlc_rate_lookup_init: invalid rate 0x%X in rate set\n", rateset->rates[i]));
7292                         continue;
7293                 }
7294
7295                 br[rate] = rate;
7296         }
7297
7298         /* The rate lookup table now has non-zero entries for each
7299          * basic rate, equal to the basic rate: br[basicN] = basicN
7300          *
7301          * To look up the best basic rate corresponding to any
7302          * particular rate, code can use the basic_rate table
7303          * like this
7304          *
7305          * basic_rate = wlc->band->basic_rate[tx_rate]
7306          *
7307          * Make sure there is a best basic rate entry for
7308          * every rate by walking up the table from low rates
7309          * to high, filling in holes in the lookup table
7310          */
7311
7312         for (i = 0; i < wlc->band->hw_rateset.count; i++) {
7313                 rate = wlc->band->hw_rateset.rates[i];
7314                 ASSERT(rate <= WLC_MAXRATE);
7315
7316                 if (br[rate] != 0) {
7317                         /* This rate is a basic rate.
7318                          * Keep track of the best basic rate so far by
7319                          * modulation type.
7320                          */
7321                         if (IS_OFDM(rate))
7322                                 ofdm_basic = rate;
7323                         else
7324                                 cck_basic = rate;
7325
7326                         continue;
7327                 }
7328
7329                 /* This rate is not a basic rate so figure out the
7330                  * best basic rate less than this rate and fill in
7331                  * the hole in the table
7332                  */
7333
7334                 br[rate] = IS_OFDM(rate) ? ofdm_basic : cck_basic;
7335
7336                 if (br[rate] != 0)
7337                         continue;
7338
7339                 if (IS_OFDM(rate)) {
7340                         /* In 11g and 11a, the OFDM mandatory rates are 6, 12, and 24 Mbps */
7341                         if (rate >= WLC_RATE_24M)
7342                                 mandatory = WLC_RATE_24M;
7343                         else if (rate >= WLC_RATE_12M)
7344                                 mandatory = WLC_RATE_12M;
7345                         else
7346                                 mandatory = WLC_RATE_6M;
7347                 } else {
7348                         /* In 11b, all the CCK rates are mandatory 1 - 11 Mbps */
7349                         mandatory = rate;
7350                 }
7351
7352                 br[rate] = mandatory;
7353         }
7354 }
7355
7356 static void wlc_write_rate_shm(wlc_info_t *wlc, u8 rate, u8 basic_rate)
7357 {
7358         u8 phy_rate, index;
7359         u8 basic_phy_rate, basic_index;
7360         u16 dir_table, basic_table;
7361         u16 basic_ptr;
7362
7363         /* Shared memory address for the table we are reading */
7364         dir_table = IS_OFDM(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
7365
7366         /* Shared memory address for the table we are writing */
7367         basic_table = IS_OFDM(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
7368
7369         /*
7370          * for a given rate, the LS-nibble of the PLCP SIGNAL field is
7371          * the index into the rate table.
7372          */
7373         phy_rate = rate_info[rate] & RATE_MASK;
7374         basic_phy_rate = rate_info[basic_rate] & RATE_MASK;
7375         index = phy_rate & 0xf;
7376         basic_index = basic_phy_rate & 0xf;
7377
7378         /* Find the SHM pointer to the ACK rate entry by looking in the
7379          * Direct-map Table
7380          */
7381         basic_ptr = wlc_read_shm(wlc, (dir_table + basic_index * 2));
7382
7383         /* Update the SHM BSS-basic-rate-set mapping table with the pointer
7384          * to the correct basic rate for the given incoming rate
7385          */
7386         wlc_write_shm(wlc, (basic_table + index * 2), basic_ptr);
7387 }
7388
7389 static const wlc_rateset_t *wlc_rateset_get_hwrs(wlc_info_t *wlc)
7390 {
7391         const wlc_rateset_t *rs_dflt;
7392
7393         if (WLC_PHY_11N_CAP(wlc->band)) {
7394                 if (BAND_5G(wlc->band->bandtype))
7395                         rs_dflt = &ofdm_mimo_rates;
7396                 else
7397                         rs_dflt = &cck_ofdm_mimo_rates;
7398         } else if (wlc->band->gmode)
7399                 rs_dflt = &cck_ofdm_rates;
7400         else
7401                 rs_dflt = &cck_rates;
7402
7403         return rs_dflt;
7404 }
7405
7406 void wlc_set_ratetable(wlc_info_t *wlc)
7407 {
7408         const wlc_rateset_t *rs_dflt;
7409         wlc_rateset_t rs;
7410         u8 rate, basic_rate;
7411         uint i;
7412
7413         rs_dflt = wlc_rateset_get_hwrs(wlc);
7414         ASSERT(rs_dflt != NULL);
7415
7416         wlc_rateset_copy(rs_dflt, &rs);
7417         wlc_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7418
7419         /* walk the phy rate table and update SHM basic rate lookup table */
7420         for (i = 0; i < rs.count; i++) {
7421                 rate = rs.rates[i] & RATE_MASK;
7422
7423                 /* for a given rate WLC_BASIC_RATE returns the rate at
7424                  * which a response ACK/CTS should be sent.
7425                  */
7426                 basic_rate = WLC_BASIC_RATE(wlc, rate);
7427                 if (basic_rate == 0) {
7428                         /* This should only happen if we are using a
7429                          * restricted rateset.
7430                          */
7431                         basic_rate = rs.rates[0] & RATE_MASK;
7432                 }
7433
7434                 wlc_write_rate_shm(wlc, rate, basic_rate);
7435         }
7436 }
7437
7438 /*
7439  * Return true if the specified rate is supported by the specified band.
7440  * WLC_BAND_AUTO indicates the current band.
7441  */
7442 bool wlc_valid_rate(wlc_info_t *wlc, ratespec_t rspec, int band, bool verbose)
7443 {
7444         wlc_rateset_t *hw_rateset;
7445         uint i;
7446
7447         if ((band == WLC_BAND_AUTO) || (band == wlc->band->bandtype)) {
7448                 hw_rateset = &wlc->band->hw_rateset;
7449         } else if (NBANDS(wlc) > 1) {
7450                 hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
7451         } else {
7452                 /* other band specified and we are a single band device */
7453                 return false;
7454         }
7455
7456         /* check if this is a mimo rate */
7457         if (IS_MCS(rspec)) {
7458                 if (!VALID_MCS((rspec & RSPEC_RATE_MASK)))
7459                         goto error;
7460
7461                 return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
7462         }
7463
7464         for (i = 0; i < hw_rateset->count; i++)
7465                 if (hw_rateset->rates[i] == RSPEC2RATE(rspec))
7466                         return true;
7467  error:
7468         if (verbose) {
7469                 WL_ERROR(("wl%d: wlc_valid_rate: rate spec 0x%x not in hw_rateset\n", wlc->pub->unit, rspec));
7470         }
7471
7472         return false;
7473 }
7474
7475 static void wlc_update_mimo_band_bwcap(wlc_info_t *wlc, u8 bwcap)
7476 {
7477         uint i;
7478         wlcband_t *band;
7479
7480         for (i = 0; i < NBANDS(wlc); i++) {
7481                 if (IS_SINGLEBAND_5G(wlc->deviceid))
7482                         i = BAND_5G_INDEX;
7483                 band = wlc->bandstate[i];
7484                 if (band->bandtype == WLC_BAND_5G) {
7485                         if ((bwcap == WLC_N_BW_40ALL)
7486                             || (bwcap == WLC_N_BW_20IN2G_40IN5G))
7487                                 band->mimo_cap_40 = true;
7488                         else
7489                                 band->mimo_cap_40 = false;
7490                 } else {
7491                         ASSERT(band->bandtype == WLC_BAND_2G);
7492                         if (bwcap == WLC_N_BW_40ALL)
7493                                 band->mimo_cap_40 = true;
7494                         else
7495                                 band->mimo_cap_40 = false;
7496                 }
7497         }
7498
7499         wlc->mimo_band_bwcap = bwcap;
7500 }
7501
7502 void wlc_mod_prb_rsp_rate_table(wlc_info_t *wlc, uint frame_len)
7503 {
7504         const wlc_rateset_t *rs_dflt;
7505         wlc_rateset_t rs;
7506         u8 rate;
7507         u16 entry_ptr;
7508         u8 plcp[D11_PHY_HDR_LEN];
7509         u16 dur, sifs;
7510         uint i;
7511
7512         sifs = SIFS(wlc->band);
7513
7514         rs_dflt = wlc_rateset_get_hwrs(wlc);
7515         ASSERT(rs_dflt != NULL);
7516
7517         wlc_rateset_copy(rs_dflt, &rs);
7518         wlc_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7519
7520         /* walk the phy rate table and update MAC core SHM basic rate table entries */
7521         for (i = 0; i < rs.count; i++) {
7522                 rate = rs.rates[i] & RATE_MASK;
7523
7524                 entry_ptr = wlc_rate_shm_offset(wlc, rate);
7525
7526                 /* Calculate the Probe Response PLCP for the given rate */
7527                 wlc_compute_plcp(wlc, rate, frame_len, plcp);
7528
7529                 /* Calculate the duration of the Probe Response frame plus SIFS for the MAC */
7530                 dur =
7531                     (u16) wlc_calc_frame_time(wlc, rate, WLC_LONG_PREAMBLE,
7532                                                  frame_len);
7533                 dur += sifs;
7534
7535                 /* Update the SHM Rate Table entry Probe Response values */
7536                 wlc_write_shm(wlc, entry_ptr + M_RT_PRS_PLCP_POS,
7537                               (u16) (plcp[0] + (plcp[1] << 8)));
7538                 wlc_write_shm(wlc, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7539                               (u16) (plcp[2] + (plcp[3] << 8)));
7540                 wlc_write_shm(wlc, entry_ptr + M_RT_PRS_DUR_POS, dur);
7541         }
7542 }
7543
7544 u16
7545 wlc_compute_bcntsfoff(wlc_info_t *wlc, ratespec_t rspec, bool short_preamble,
7546                       bool phydelay)
7547 {
7548         uint bcntsfoff = 0;
7549
7550         if (IS_MCS(rspec)) {
7551                 WL_ERROR(("wl%d: recd beacon with mcs rate; rspec 0x%x\n",
7552                           wlc->pub->unit, rspec));
7553         } else if (IS_OFDM(rspec)) {
7554                 /* tx delay from MAC through phy to air (2.1 usec) +
7555                  * phy header time (preamble + PLCP SIGNAL == 20 usec) +
7556                  * PLCP SERVICE + MAC header time (SERVICE + FC + DUR + A1 + A2 + A3 + SEQ == 26
7557                  * bytes at beacon rate)
7558                  */
7559                 bcntsfoff += phydelay ? D11A_PHY_TX_DELAY : 0;
7560                 bcntsfoff += APHY_PREAMBLE_TIME + APHY_SIGNAL_TIME;
7561                 bcntsfoff +=
7562                     wlc_compute_airtime(wlc, rspec,
7563                                         APHY_SERVICE_NBITS / 8 +
7564                                         DOT11_MAC_HDR_LEN);
7565         } else {
7566                 /* tx delay from MAC through phy to air (3.4 usec) +
7567                  * phy header time (long preamble + PLCP == 192 usec) +
7568                  * MAC header time (FC + DUR + A1 + A2 + A3 + SEQ == 24 bytes at beacon rate)
7569                  */
7570                 bcntsfoff += phydelay ? D11B_PHY_TX_DELAY : 0;
7571                 bcntsfoff +=
7572                     short_preamble ? D11B_PHY_SPREHDR_TIME :
7573                     D11B_PHY_LPREHDR_TIME;
7574                 bcntsfoff += wlc_compute_airtime(wlc, rspec, DOT11_MAC_HDR_LEN);
7575         }
7576         return (u16) (bcntsfoff);
7577 }
7578
7579 /*      Max buffering needed for beacon template/prb resp template is 142 bytes.
7580  *
7581  *      PLCP header is 6 bytes.
7582  *      802.11 A3 header is 24 bytes.
7583  *      Max beacon frame body template length is 112 bytes.
7584  *      Max probe resp frame body template length is 110 bytes.
7585  *
7586  *      *len on input contains the max length of the packet available.
7587  *
7588  *      The *len value is set to the number of bytes in buf used, and starts with the PLCP
7589  *      and included up to, but not including, the 4 byte FCS.
7590  */
7591 static void
7592 wlc_bcn_prb_template(wlc_info_t *wlc, uint type, ratespec_t bcn_rspec,
7593                      wlc_bsscfg_t *cfg, u16 *buf, int *len)
7594 {
7595         cck_phy_hdr_t *plcp;
7596         struct dot11_management_header *h;
7597         int hdr_len, body_len;
7598
7599         ASSERT(*len >= 142);
7600         ASSERT(type == FC_BEACON || type == FC_PROBE_RESP);
7601
7602         if (MBSS_BCN_ENAB(cfg) && type == FC_BEACON)
7603                 hdr_len = DOT11_MAC_HDR_LEN;
7604         else
7605                 hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
7606         body_len = *len - hdr_len;      /* calc buffer size provided for frame body */
7607
7608         *len = hdr_len + body_len;      /* return actual size */
7609
7610         /* format PHY and MAC headers */
7611         bzero((char *)buf, hdr_len);
7612
7613         plcp = (cck_phy_hdr_t *) buf;
7614
7615         /* PLCP for Probe Response frames are filled in from core's rate table */
7616         if (type == FC_BEACON && !MBSS_BCN_ENAB(cfg)) {
7617                 /* fill in PLCP */
7618                 wlc_compute_plcp(wlc, bcn_rspec,
7619                                  (DOT11_MAC_HDR_LEN + body_len + DOT11_FCS_LEN),
7620                                  (u8 *) plcp);
7621
7622         }
7623         /* "Regular" and 16 MBSS but not for 4 MBSS */
7624         /* Update the phytxctl for the beacon based on the rspec */
7625         if (!SOFTBCN_ENAB(cfg))
7626                 wlc_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
7627
7628         if (MBSS_BCN_ENAB(cfg) && type == FC_BEACON)
7629                 h = (struct dot11_management_header *)&plcp[0];
7630         else
7631                 h = (struct dot11_management_header *)&plcp[1];
7632
7633         /* fill in 802.11 header */
7634         h->fc = htol16((u16) type);
7635
7636         /* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
7637         /* A1 filled in by MAC for prb resp, broadcast for bcn */
7638         if (type == FC_BEACON)
7639                 bcopy((const char *)&ether_bcast, (char *)&h->da,
7640                       ETHER_ADDR_LEN);
7641         bcopy((char *)&cfg->cur_etheraddr, (char *)&h->sa, ETHER_ADDR_LEN);
7642         bcopy((char *)&cfg->BSSID, (char *)&h->bssid, ETHER_ADDR_LEN);
7643
7644         /* SEQ filled in by MAC */
7645
7646         return;
7647 }
7648
7649 int wlc_get_header_len()
7650 {
7651         return TXOFF;
7652 }
7653
7654 /* Update a beacon for a particular BSS
7655  * For MBSS, this updates the software template and sets "latest" to the index of the
7656  * template updated.
7657  * Otherwise, it updates the hardware template.
7658  */
7659 void wlc_bss_update_beacon(wlc_info_t *wlc, wlc_bsscfg_t *cfg)
7660 {
7661         int len = BCN_TMPL_LEN;
7662
7663         /* Clear the soft intmask */
7664         wlc->defmacintmask &= ~MI_BCNTPL;
7665
7666         if (!cfg->up) {         /* Only allow updates on an UP bss */
7667                 return;
7668         }
7669
7670         if (MBSS_BCN_ENAB(cfg)) {       /* Optimize:  Some of if/else could be combined */
7671         } else if (HWBCN_ENAB(cfg)) {   /* Hardware beaconing for this config */
7672                 u16 bcn[BCN_TMPL_LEN / 2];
7673                 u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7674                 d11regs_t *regs = wlc->regs;
7675                 struct osl_info *osh = NULL;
7676
7677                 osh = wlc->osh;
7678
7679                 /* Check if both templates are in use, if so sched. an interrupt
7680                  *      that will call back into this routine
7681                  */
7682                 if ((R_REG(osh, &regs->maccommand) & both_valid) == both_valid) {
7683                         /* clear any previous status */
7684                         W_REG(osh, &regs->macintstatus, MI_BCNTPL);
7685                 }
7686                 /* Check that after scheduling the interrupt both of the
7687                  *      templates are still busy. if not clear the int. & remask
7688                  */
7689                 if ((R_REG(osh, &regs->maccommand) & both_valid) == both_valid) {
7690                         wlc->defmacintmask |= MI_BCNTPL;
7691                         return;
7692                 }
7693
7694                 wlc->bcn_rspec =
7695                     wlc_lowest_basic_rspec(wlc, &cfg->current_bss->rateset);
7696                 ASSERT(wlc_valid_rate
7697                        (wlc, wlc->bcn_rspec,
7698                         CHSPEC_IS2G(cfg->current_bss->
7699                                     chanspec) ? WLC_BAND_2G : WLC_BAND_5G,
7700                         true));
7701
7702                 /* update the template and ucode shm */
7703                 wlc_bcn_prb_template(wlc, FC_BEACON, wlc->bcn_rspec, cfg, bcn,
7704                                      &len);
7705                 wlc_write_hw_bcntemplates(wlc, bcn, len, false);
7706         }
7707 }
7708
7709 /*
7710  * Update all beacons for the system.
7711  */
7712 void wlc_update_beacon(wlc_info_t *wlc)
7713 {
7714         int idx;
7715         wlc_bsscfg_t *bsscfg;
7716
7717         /* update AP or IBSS beacons */
7718         FOREACH_BSS(wlc, idx, bsscfg) {
7719                 if (bsscfg->up && (BSSCFG_AP(bsscfg) || !bsscfg->BSS))
7720                         wlc_bss_update_beacon(wlc, bsscfg);
7721         }
7722 }
7723
7724 /* Write ssid into shared memory */
7725 void wlc_shm_ssid_upd(wlc_info_t *wlc, wlc_bsscfg_t *cfg)
7726 {
7727         u8 *ssidptr = cfg->SSID;
7728         u16 base = M_SSID;
7729         u8 ssidbuf[DOT11_MAX_SSID_LEN];
7730
7731         /* padding the ssid with zero and copy it into shm */
7732         bzero(ssidbuf, DOT11_MAX_SSID_LEN);
7733         bcopy(ssidptr, ssidbuf, cfg->SSID_len);
7734
7735         wlc_copyto_shm(wlc, base, ssidbuf, DOT11_MAX_SSID_LEN);
7736
7737         if (!MBSS_BCN_ENAB(cfg))
7738                 wlc_write_shm(wlc, M_SSIDLEN, (u16) cfg->SSID_len);
7739 }
7740
7741 void wlc_update_probe_resp(wlc_info_t *wlc, bool suspend)
7742 {
7743         int idx;
7744         wlc_bsscfg_t *bsscfg;
7745
7746         /* update AP or IBSS probe responses */
7747         FOREACH_BSS(wlc, idx, bsscfg) {
7748                 if (bsscfg->up && (BSSCFG_AP(bsscfg) || !bsscfg->BSS))
7749                         wlc_bss_update_probe_resp(wlc, bsscfg, suspend);
7750         }
7751 }
7752
7753 void
7754 wlc_bss_update_probe_resp(wlc_info_t *wlc, wlc_bsscfg_t *cfg, bool suspend)
7755 {
7756         u16 prb_resp[BCN_TMPL_LEN / 2];
7757         int len = BCN_TMPL_LEN;
7758
7759         /* write the probe response to hardware, or save in the config structure */
7760         if (!MBSS_PRB_ENAB(cfg)) {
7761
7762                 /* create the probe response template */
7763                 wlc_bcn_prb_template(wlc, FC_PROBE_RESP, 0, cfg, prb_resp,
7764                                      &len);
7765
7766                 if (suspend)
7767                         wlc_suspend_mac_and_wait(wlc);
7768
7769                 /* write the probe response into the template region */
7770                 wlc_bmac_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7771                                             (len + 3) & ~3, prb_resp);
7772
7773                 /* write the length of the probe response frame (+PLCP/-FCS) */
7774                 wlc_write_shm(wlc, M_PRB_RESP_FRM_LEN, (u16) len);
7775
7776                 /* write the SSID and SSID length */
7777                 wlc_shm_ssid_upd(wlc, cfg);
7778
7779                 /*
7780                  * Write PLCP headers and durations for probe response frames at all rates.
7781                  * Use the actual frame length covered by the PLCP header for the call to
7782                  * wlc_mod_prb_rsp_rate_table() by subtracting the PLCP len and adding the FCS.
7783                  */
7784                 len += (-D11_PHY_HDR_LEN + DOT11_FCS_LEN);
7785                 wlc_mod_prb_rsp_rate_table(wlc, (u16) len);
7786
7787                 if (suspend)
7788                         wlc_enable_mac(wlc);
7789         } else {                /* Generating probe resp in sw; update local template */
7790                 ASSERT(0 && "No software probe response support without MBSS");
7791         }
7792 }
7793
7794 /* prepares pdu for transmission. returns BCM error codes */
7795 int wlc_prep_pdu(wlc_info_t *wlc, struct sk_buff *pdu, uint *fifop)
7796 {
7797         struct osl_info *osh;
7798         uint fifo;
7799         d11txh_t *txh;
7800         struct dot11_header *h;
7801         struct scb *scb;
7802         u16 fc;
7803
7804         osh = wlc->osh;
7805
7806         ASSERT(pdu);
7807         txh = (d11txh_t *) (pdu->data);
7808         ASSERT(txh);
7809         h = (struct dot11_header *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
7810         ASSERT(h);
7811         fc = ltoh16(h->fc);
7812
7813         /* get the pkt queue info. This was put at wlc_sendctl or wlc_send for PDU */
7814         fifo = ltoh16(txh->TxFrameID) & TXFID_QUEUE_MASK;
7815
7816         scb = NULL;
7817
7818         *fifop = fifo;
7819
7820         /* return if insufficient dma resources */
7821         if (TXAVAIL(wlc, fifo) < MAX_DMA_SEGS) {
7822                 /* Mark precedences related to this FIFO, unsendable */
7823                 WLC_TX_FIFO_CLEAR(wlc, fifo);
7824                 return BCME_BUSY;
7825         }
7826
7827         if (FC_TYPE(ltoh16(txh->MacFrameControl)) != FC_TYPE_DATA)
7828                 WLCNTINCR(wlc->pub->_cnt->txctl);
7829
7830         return 0;
7831 }
7832
7833 /* init tx reported rate mechanism */
7834 void wlc_reprate_init(wlc_info_t *wlc)
7835 {
7836         int i;
7837         wlc_bsscfg_t *bsscfg;
7838
7839         FOREACH_BSS(wlc, i, bsscfg) {
7840                 wlc_bsscfg_reprate_init(bsscfg);
7841         }
7842 }
7843
7844 /* per bsscfg init tx reported rate mechanism */
7845 void wlc_bsscfg_reprate_init(wlc_bsscfg_t *bsscfg)
7846 {
7847         bsscfg->txrspecidx = 0;
7848         bzero((char *)bsscfg->txrspec, sizeof(bsscfg->txrspec));
7849 }
7850
7851 /* Retrieve a consolidated set of revision information,
7852  * typically for the WLC_GET_REVINFO ioctl
7853  */
7854 int wlc_get_revision_info(wlc_info_t *wlc, void *buf, uint len)
7855 {
7856         wlc_rev_info_t *rinfo = (wlc_rev_info_t *) buf;
7857
7858         if (len < WL_REV_INFO_LEGACY_LENGTH)
7859                 return BCME_BUFTOOSHORT;
7860
7861         rinfo->vendorid = wlc->vendorid;
7862         rinfo->deviceid = wlc->deviceid;
7863         rinfo->radiorev = (wlc->band->radiorev << IDCODE_REV_SHIFT) |
7864             (wlc->band->radioid << IDCODE_ID_SHIFT);
7865         rinfo->chiprev = wlc->pub->sih->chiprev;
7866         rinfo->corerev = wlc->pub->corerev;
7867         rinfo->boardid = wlc->pub->sih->boardtype;
7868         rinfo->boardvendor = wlc->pub->sih->boardvendor;
7869         rinfo->boardrev = wlc->pub->boardrev;
7870         rinfo->ucoderev = wlc->ucode_rev;
7871         rinfo->driverrev = EPI_VERSION_NUM;
7872         rinfo->bus = wlc->pub->sih->bustype;
7873         rinfo->chipnum = wlc->pub->sih->chip;
7874
7875         if (len >= (offsetof(wlc_rev_info_t, chippkg))) {
7876                 rinfo->phytype = wlc->band->phytype;
7877                 rinfo->phyrev = wlc->band->phyrev;
7878                 rinfo->anarev = 0;      /* obsolete stuff, suppress */
7879         }
7880
7881         if (len >= sizeof(*rinfo)) {
7882                 rinfo->chippkg = wlc->pub->sih->chippkg;
7883         }
7884
7885         return BCME_OK;
7886 }
7887
7888 void wlc_default_rateset(wlc_info_t *wlc, wlc_rateset_t *rs)
7889 {
7890         wlc_rateset_default(rs, NULL, wlc->band->phytype, wlc->band->bandtype,
7891                             false, RATE_MASK_FULL, (bool) N_ENAB(wlc->pub),
7892                             CHSPEC_WLC_BW(wlc->default_bss->chanspec),
7893                             wlc->stf->txstreams);
7894 }
7895
7896 static void wlc_bss_default_init(wlc_info_t *wlc)
7897 {
7898         chanspec_t chanspec;
7899         wlcband_t *band;
7900         wlc_bss_info_t *bi = wlc->default_bss;
7901
7902         /* init default and target BSS with some sane initial values */
7903         bzero((char *)(bi), sizeof(wlc_bss_info_t));
7904         bi->beacon_period = ISSIM_ENAB(wlc->pub->sih) ? BEACON_INTERVAL_DEF_QT :
7905             BEACON_INTERVAL_DEFAULT;
7906         bi->dtim_period = ISSIM_ENAB(wlc->pub->sih) ? DTIM_INTERVAL_DEF_QT :
7907             DTIM_INTERVAL_DEFAULT;
7908
7909         /* fill the default channel as the first valid channel
7910          * starting from the 2G channels
7911          */
7912         chanspec = CH20MHZ_CHSPEC(1);
7913         ASSERT(chanspec != INVCHANSPEC);
7914
7915         wlc->home_chanspec = bi->chanspec = chanspec;
7916
7917         /* find the band of our default channel */
7918         band = wlc->band;
7919         if (NBANDS(wlc) > 1 && band->bandunit != CHSPEC_WLCBANDUNIT(chanspec))
7920                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
7921
7922         /* init bss rates to the band specific default rate set */
7923         wlc_rateset_default(&bi->rateset, NULL, band->phytype, band->bandtype,
7924                             false, RATE_MASK_FULL, (bool) N_ENAB(wlc->pub),
7925                             CHSPEC_WLC_BW(chanspec), wlc->stf->txstreams);
7926
7927         if (N_ENAB(wlc->pub))
7928                 bi->flags |= WLC_BSS_HT;
7929 }
7930
7931 /* Deferred event processing */
7932 static void wlc_process_eventq(void *arg)
7933 {
7934         wlc_info_t *wlc = (wlc_info_t *) arg;
7935         wlc_event_t *etmp;
7936
7937         while ((etmp = wlc_eventq_deq(wlc->eventq))) {
7938                 /* Perform OS specific event processing */
7939                 wl_event(wlc->wl, etmp->event.ifname, etmp);
7940                 if (etmp->data) {
7941                         kfree(etmp->data);
7942                         etmp->data = NULL;
7943                 }
7944                 wlc_event_free(wlc->eventq, etmp);
7945         }
7946 }
7947
7948 void
7949 wlc_uint64_sub(u32 *a_high, u32 *a_low, u32 b_high, u32 b_low)
7950 {
7951         if (b_low > *a_low) {
7952                 /* low half needs a carry */
7953                 b_high += 1;
7954         }
7955         *a_low -= b_low;
7956         *a_high -= b_high;
7957 }
7958
7959 static ratespec_t
7960 mac80211_wlc_set_nrate(wlc_info_t *wlc, wlcband_t *cur_band, u32 int_val)
7961 {
7962         u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
7963         u8 rate = int_val & NRATE_RATE_MASK;
7964         ratespec_t rspec;
7965         bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
7966         bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
7967         bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
7968                                   == NRATE_OVERRIDE_MCS_ONLY);
7969         int bcmerror = 0;
7970
7971         if (!ismcs) {
7972                 return (ratespec_t) rate;
7973         }
7974
7975         /* validate the combination of rate/mcs/stf is allowed */
7976         if (N_ENAB(wlc->pub) && ismcs) {
7977                 /* mcs only allowed when nmode */
7978                 if (stf > PHY_TXC1_MODE_SDM) {
7979                         WL_ERROR(("wl%d: %s: Invalid stf\n", WLCWLUNIT(wlc),
7980                                   __func__));
7981                         bcmerror = BCME_RANGE;
7982                         goto done;
7983                 }
7984
7985                 /* mcs 32 is a special case, DUP mode 40 only */
7986                 if (rate == 32) {
7987                         if (!CHSPEC_IS40(wlc->home_chanspec) ||
7988                             ((stf != PHY_TXC1_MODE_SISO)
7989                              && (stf != PHY_TXC1_MODE_CDD))) {
7990                                 WL_ERROR(("wl%d: %s: Invalid mcs 32\n",
7991                                           WLCWLUNIT(wlc), __func__));
7992                                 bcmerror = BCME_RANGE;
7993                                 goto done;
7994                         }
7995                         /* mcs > 7 must use stf SDM */
7996                 } else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
7997                         /* mcs > 7 must use stf SDM */
7998                         if (stf != PHY_TXC1_MODE_SDM) {
7999                                 WL_TRACE(("wl%d: %s: enabling SDM mode for mcs %d\n", WLCWLUNIT(wlc), __func__, rate));
8000                                 stf = PHY_TXC1_MODE_SDM;
8001                         }
8002                 } else {
8003                         /* MCS 0-7 may use SISO, CDD, and for phy_rev >= 3 STBC */
8004                         if ((stf > PHY_TXC1_MODE_STBC) ||
8005                             (!WLC_STBC_CAP_PHY(wlc)
8006                              && (stf == PHY_TXC1_MODE_STBC))) {
8007                                 WL_ERROR(("wl%d: %s: Invalid STBC\n",
8008                                           WLCWLUNIT(wlc), __func__));
8009                                 bcmerror = BCME_RANGE;
8010                                 goto done;
8011                         }
8012                 }
8013         } else if (IS_OFDM(rate)) {
8014                 if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
8015                         WL_ERROR(("wl%d: %s: Invalid OFDM\n", WLCWLUNIT(wlc),
8016                                   __func__));
8017                         bcmerror = BCME_RANGE;
8018                         goto done;
8019                 }
8020         } else if (IS_CCK(rate)) {
8021                 if ((cur_band->bandtype != WLC_BAND_2G)
8022                     || (stf != PHY_TXC1_MODE_SISO)) {
8023                         WL_ERROR(("wl%d: %s: Invalid CCK\n", WLCWLUNIT(wlc),
8024                                   __func__));
8025                         bcmerror = BCME_RANGE;
8026                         goto done;
8027                 }
8028         } else {
8029                 WL_ERROR(("wl%d: %s: Unknown rate type\n", WLCWLUNIT(wlc),
8030                           __func__));
8031                 bcmerror = BCME_RANGE;
8032                 goto done;
8033         }
8034         /* make sure multiple antennae are available for non-siso rates */
8035         if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
8036                 WL_ERROR(("wl%d: %s: SISO antenna but !SISO request\n",
8037                           WLCWLUNIT(wlc), __func__));
8038                 bcmerror = BCME_RANGE;
8039                 goto done;
8040         }
8041
8042         rspec = rate;
8043         if (ismcs) {
8044                 rspec |= RSPEC_MIMORATE;
8045                 /* For STBC populate the STC field of the ratespec */
8046                 if (stf == PHY_TXC1_MODE_STBC) {
8047                         u8 stc;
8048                         stc = 1;        /* Nss for single stream is always 1 */
8049                         rspec |= (stc << RSPEC_STC_SHIFT);
8050                 }
8051         }
8052
8053         rspec |= (stf << RSPEC_STF_SHIFT);
8054
8055         if (override_mcs_only)
8056                 rspec |= RSPEC_OVERRIDE_MCS_ONLY;
8057
8058         if (issgi)
8059                 rspec |= RSPEC_SHORT_GI;
8060
8061         if ((rate != 0)
8062             && !wlc_valid_rate(wlc, rspec, cur_band->bandtype, true)) {
8063                 return rate;
8064         }
8065
8066         return rspec;
8067  done:
8068         WL_ERROR(("Hoark\n"));
8069         return rate;
8070 }
8071
8072 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
8073 static int
8074 wlc_duty_cycle_set(wlc_info_t *wlc, int duty_cycle, bool isOFDM,
8075                    bool writeToShm)
8076 {
8077         int idle_busy_ratio_x_16 = 0;
8078         uint offset =
8079             isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
8080             M_TX_IDLE_BUSY_RATIO_X_16_CCK;
8081         if (duty_cycle > 100 || duty_cycle < 0) {
8082                 WL_ERROR(("wl%d:  duty cycle value off limit\n",
8083                           wlc->pub->unit));
8084                 return BCME_RANGE;
8085         }
8086         if (duty_cycle)
8087                 idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
8088         /* Only write to shared memory  when wl is up */
8089         if (writeToShm)
8090                 wlc_write_shm(wlc, offset, (u16) idle_busy_ratio_x_16);
8091
8092         if (isOFDM)
8093                 wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
8094         else
8095                 wlc->tx_duty_cycle_cck = (u16) duty_cycle;
8096
8097         return BCME_OK;
8098 }
8099
8100 /* Read a single u16 from shared memory.
8101  * SHM 'offset' needs to be an even address
8102  */
8103 u16 wlc_read_shm(wlc_info_t *wlc, uint offset)
8104 {
8105         return wlc_bmac_read_shm(wlc->hw, offset);
8106 }
8107
8108 /* Write a single u16 to shared memory.
8109  * SHM 'offset' needs to be an even address
8110  */
8111 void wlc_write_shm(wlc_info_t *wlc, uint offset, u16 v)
8112 {
8113         wlc_bmac_write_shm(wlc->hw, offset, v);
8114 }
8115
8116 /* Set a range of shared memory to a value.
8117  * SHM 'offset' needs to be an even address and
8118  * Range length 'len' must be an even number of bytes
8119  */
8120 void wlc_set_shm(wlc_info_t *wlc, uint offset, u16 v, int len)
8121 {
8122         /* offset and len need to be even */
8123         ASSERT((offset & 1) == 0);
8124         ASSERT((len & 1) == 0);
8125
8126         if (len <= 0)
8127                 return;
8128
8129         wlc_bmac_set_shm(wlc->hw, offset, v, len);
8130 }
8131
8132 /* Copy a buffer to shared memory.
8133  * SHM 'offset' needs to be an even address and
8134  * Buffer length 'len' must be an even number of bytes
8135  */
8136 void wlc_copyto_shm(wlc_info_t *wlc, uint offset, const void *buf, int len)
8137 {
8138         /* offset and len need to be even */
8139         ASSERT((offset & 1) == 0);
8140         ASSERT((len & 1) == 0);
8141
8142         if (len <= 0)
8143                 return;
8144         wlc_bmac_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
8145
8146 }
8147
8148 /* Copy from shared memory to a buffer.
8149  * SHM 'offset' needs to be an even address and
8150  * Buffer length 'len' must be an even number of bytes
8151  */
8152 void wlc_copyfrom_shm(wlc_info_t *wlc, uint offset, void *buf, int len)
8153 {
8154         /* offset and len need to be even */
8155         ASSERT((offset & 1) == 0);
8156         ASSERT((len & 1) == 0);
8157
8158         if (len <= 0)
8159                 return;
8160
8161         wlc_bmac_copyfrom_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
8162 }
8163
8164 /* wrapper BMAC functions to for HIGH driver access */
8165 void wlc_mctrl(wlc_info_t *wlc, u32 mask, u32 val)
8166 {
8167         wlc_bmac_mctrl(wlc->hw, mask, val);
8168 }
8169
8170 void wlc_corereset(wlc_info_t *wlc, u32 flags)
8171 {
8172         wlc_bmac_corereset(wlc->hw, flags);
8173 }
8174
8175 void wlc_mhf(wlc_info_t *wlc, u8 idx, u16 mask, u16 val, int bands)
8176 {
8177         wlc_bmac_mhf(wlc->hw, idx, mask, val, bands);
8178 }
8179
8180 u16 wlc_mhf_get(wlc_info_t *wlc, u8 idx, int bands)
8181 {
8182         return wlc_bmac_mhf_get(wlc->hw, idx, bands);
8183 }
8184
8185 int wlc_xmtfifo_sz_get(wlc_info_t *wlc, uint fifo, uint *blocks)
8186 {
8187         return wlc_bmac_xmtfifo_sz_get(wlc->hw, fifo, blocks);
8188 }
8189
8190 void wlc_write_template_ram(wlc_info_t *wlc, int offset, int len, void *buf)
8191 {
8192         wlc_bmac_write_template_ram(wlc->hw, offset, len, buf);
8193 }
8194
8195 void wlc_write_hw_bcntemplates(wlc_info_t *wlc, void *bcn, int len, bool both)
8196 {
8197         wlc_bmac_write_hw_bcntemplates(wlc->hw, bcn, len, both);
8198 }
8199
8200 void
8201 wlc_set_addrmatch(wlc_info_t *wlc, int match_reg_offset,
8202                   const struct ether_addr *addr)
8203 {
8204         wlc_bmac_set_addrmatch(wlc->hw, match_reg_offset, addr);
8205 }
8206
8207 void wlc_set_rcmta(wlc_info_t *wlc, int idx, const struct ether_addr *addr)
8208 {
8209         wlc_bmac_set_rcmta(wlc->hw, idx, addr);
8210 }
8211
8212 void wlc_read_tsf(wlc_info_t *wlc, u32 *tsf_l_ptr, u32 *tsf_h_ptr)
8213 {
8214         wlc_bmac_read_tsf(wlc->hw, tsf_l_ptr, tsf_h_ptr);
8215 }
8216
8217 void wlc_set_cwmin(wlc_info_t *wlc, u16 newmin)
8218 {
8219         wlc->band->CWmin = newmin;
8220         wlc_bmac_set_cwmin(wlc->hw, newmin);
8221 }
8222
8223 void wlc_set_cwmax(wlc_info_t *wlc, u16 newmax)
8224 {
8225         wlc->band->CWmax = newmax;
8226         wlc_bmac_set_cwmax(wlc->hw, newmax);
8227 }
8228
8229 void wlc_fifoerrors(wlc_info_t *wlc)
8230 {
8231
8232         wlc_bmac_fifoerrors(wlc->hw);
8233 }
8234
8235 /* Search mem rw utilities */
8236
8237 void wlc_pllreq(wlc_info_t *wlc, bool set, mbool req_bit)
8238 {
8239         wlc_bmac_pllreq(wlc->hw, set, req_bit);
8240 }
8241
8242 void wlc_reset_bmac_done(wlc_info_t *wlc)
8243 {
8244 }
8245
8246 void wlc_ht_mimops_cap_update(wlc_info_t *wlc, u8 mimops_mode)
8247 {
8248         wlc->ht_cap.cap &= ~HT_CAP_MIMO_PS_MASK;
8249         wlc->ht_cap.cap |= (mimops_mode << HT_CAP_MIMO_PS_SHIFT);
8250
8251         if (AP_ENAB(wlc->pub) && wlc->clk) {
8252                 wlc_update_beacon(wlc);
8253                 wlc_update_probe_resp(wlc, true);
8254         }
8255 }
8256
8257 /* check for the particular priority flow control bit being set */
8258 bool
8259 wlc_txflowcontrol_prio_isset(wlc_info_t *wlc, wlc_txq_info_t *q, int prio)
8260 {
8261         uint prio_mask;
8262
8263         if (prio == ALLPRIO) {
8264                 prio_mask = TXQ_STOP_FOR_PRIOFC_MASK;
8265         } else {
8266                 ASSERT(prio >= 0 && prio <= MAXPRIO);
8267                 prio_mask = NBITVAL(prio);
8268         }
8269
8270         return (q->stopped & prio_mask) == prio_mask;
8271 }
8272
8273 /* propogate the flow control to all interfaces using the given tx queue */
8274 void wlc_txflowcontrol(wlc_info_t *wlc, wlc_txq_info_t *qi, bool on, int prio)
8275 {
8276         uint prio_bits;
8277         uint cur_bits;
8278
8279         WL_ERROR(("%s: flow contro kicks in\n", __func__));
8280
8281         if (prio == ALLPRIO) {
8282                 prio_bits = TXQ_STOP_FOR_PRIOFC_MASK;
8283         } else {
8284                 ASSERT(prio >= 0 && prio <= MAXPRIO);
8285                 prio_bits = NBITVAL(prio);
8286         }
8287
8288         cur_bits = qi->stopped & prio_bits;
8289
8290         /* Check for the case of no change and return early
8291          * Otherwise update the bit and continue
8292          */
8293         if (on) {
8294                 if (cur_bits == prio_bits) {
8295                         return;
8296                 }
8297                 mboolset(qi->stopped, prio_bits);
8298         } else {
8299                 if (cur_bits == 0) {
8300                         return;
8301                 }
8302                 mboolclr(qi->stopped, prio_bits);
8303         }
8304
8305         /* If there is a flow control override we will not change the external
8306          * flow control state.
8307          */
8308         if (qi->stopped & ~TXQ_STOP_FOR_PRIOFC_MASK) {
8309                 return;
8310         }
8311
8312         wlc_txflowcontrol_signal(wlc, qi, on, prio);
8313 }
8314
8315 void
8316 wlc_txflowcontrol_override(wlc_info_t *wlc, wlc_txq_info_t *qi, bool on,
8317                            uint override)
8318 {
8319         uint prev_override;
8320
8321         ASSERT(override != 0);
8322         ASSERT((override & TXQ_STOP_FOR_PRIOFC_MASK) == 0);
8323
8324         prev_override = (qi->stopped & ~TXQ_STOP_FOR_PRIOFC_MASK);
8325
8326         /* Update the flow control bits and do an early return if there is
8327          * no change in the external flow control state.
8328          */
8329         if (on) {
8330                 mboolset(qi->stopped, override);
8331                 /* if there was a previous override bit on, then setting this
8332                  * makes no difference.
8333                  */
8334                 if (prev_override) {
8335                         return;
8336                 }
8337
8338                 wlc_txflowcontrol_signal(wlc, qi, ON, ALLPRIO);
8339         } else {
8340                 mboolclr(qi->stopped, override);
8341                 /* clearing an override bit will only make a difference for
8342                  * flow control if it was the only bit set. For any other
8343                  * override setting, just return
8344                  */
8345                 if (prev_override != override) {
8346                         return;
8347                 }
8348
8349                 if (qi->stopped == 0) {
8350                         wlc_txflowcontrol_signal(wlc, qi, OFF, ALLPRIO);
8351                 } else {
8352                         int prio;
8353
8354                         for (prio = MAXPRIO; prio >= 0; prio--) {
8355                                 if (!mboolisset(qi->stopped, NBITVAL(prio)))
8356                                         wlc_txflowcontrol_signal(wlc, qi, OFF,
8357                                                                  prio);
8358                         }
8359                 }
8360         }
8361 }
8362
8363 static void wlc_txflowcontrol_reset(wlc_info_t *wlc)
8364 {
8365         wlc_txq_info_t *qi;
8366
8367         for (qi = wlc->tx_queues; qi != NULL; qi = qi->next) {
8368                 if (qi->stopped) {
8369                         wlc_txflowcontrol_signal(wlc, qi, OFF, ALLPRIO);
8370                         qi->stopped = 0;
8371                 }
8372         }
8373 }
8374
8375 static void
8376 wlc_txflowcontrol_signal(wlc_info_t *wlc, wlc_txq_info_t *qi, bool on,
8377                          int prio)
8378 {
8379         wlc_if_t *wlcif;
8380
8381         for (wlcif = wlc->wlcif_list; wlcif != NULL; wlcif = wlcif->next) {
8382                 if (wlcif->qi == qi && wlcif->flags & WLC_IF_LINKED)
8383                         wl_txflowcontrol(wlc->wl, wlcif->wlif, on, prio);
8384         }
8385 }
8386
8387 static wlc_txq_info_t *wlc_txq_alloc(wlc_info_t *wlc, struct osl_info *osh)
8388 {
8389         wlc_txq_info_t *qi, *p;
8390
8391         qi = (wlc_txq_info_t *) wlc_calloc(osh, wlc->pub->unit,
8392                                            sizeof(wlc_txq_info_t));
8393         if (qi == NULL) {
8394                 return NULL;
8395         }
8396
8397         /* Have enough room for control packets along with HI watermark */
8398         /* Also, add room to txq for total psq packets if all the SCBs leave PS mode */
8399         /* The watermark for flowcontrol to OS packets will remain the same */
8400         pktq_init(&qi->q, WLC_PREC_COUNT,
8401                   (2 * wlc->pub->tunables->datahiwat) + PKTQ_LEN_DEFAULT +
8402                   wlc->pub->psq_pkts_total);
8403
8404         /* add this queue to the the global list */
8405         p = wlc->tx_queues;
8406         if (p == NULL) {
8407                 wlc->tx_queues = qi;
8408         } else {
8409                 while (p->next != NULL)
8410                         p = p->next;
8411                 p->next = qi;
8412         }
8413
8414         return qi;
8415 }
8416
8417 static void wlc_txq_free(wlc_info_t *wlc, struct osl_info *osh,
8418                          wlc_txq_info_t *qi)
8419 {
8420         wlc_txq_info_t *p;
8421
8422         if (qi == NULL)
8423                 return;
8424
8425         /* remove the queue from the linked list */
8426         p = wlc->tx_queues;
8427         if (p == qi)
8428                 wlc->tx_queues = p->next;
8429         else {
8430                 while (p != NULL && p->next != qi)
8431                         p = p->next;
8432                 ASSERT(p->next == qi);
8433                 if (p != NULL)
8434                         p->next = p->next->next;
8435         }
8436
8437         kfree(qi);
8438 }