drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_qos = 1;
  84 module_param_named(qos, modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  94
  95
  96 static const struct ssb_device_id b43_ssb_tbl[] = {
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 106         SSB_DEVTABLE_END
 107 };
 108
 109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 110
 111 /* Channel and ratetables are shared for all devices.
 112  * They can't be const, because ieee80211 puts some precalculated
 113  * data in there. This data is the same for all devices, so we don't
 114  * get concurrency issues */
 115 #define RATETAB_ENT(_rateid, _flags) \
 116         {                                                               \
 117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 118                 .hw_value       = (_rateid),                            \
 119                 .flags          = (_flags),                             \
 120         }
 121
 122 /*
 123  * NOTE: When changing this, sync with xmit.c's
 124  *       b43_plcp_get_bitrate_idx_* functions!
 125  */
 126 static struct ieee80211_rate __b43_ratetable[] = {
 127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 139 };
 140
 141 #define b43_a_ratetable         (__b43_ratetable + 4)
 142 #define b43_a_ratetable_size    8
 143 #define b43_b_ratetable         (__b43_ratetable + 0)
 144 #define b43_b_ratetable_size    4
 145 #define b43_g_ratetable         (__b43_ratetable + 0)
 146 #define b43_g_ratetable_size    12
 147
 148 #define CHAN4G(_channel, _freq, _flags) {                       \
 149         .band                   = IEEE80211_BAND_2GHZ,          \
 150         .center_freq            = (_freq),                      \
 151         .hw_value               = (_channel),                   \
 152         .flags                  = (_flags),                     \
 153         .max_antenna_gain       = 0,                            \
 154         .max_power              = 30,                           \
 155 }
 156 static struct ieee80211_channel b43_2ghz_chantable[] = {
 157         CHAN4G(1, 2412, 0),
 158         CHAN4G(2, 2417, 0),
 159         CHAN4G(3, 2422, 0),
 160         CHAN4G(4, 2427, 0),
 161         CHAN4G(5, 2432, 0),
 162         CHAN4G(6, 2437, 0),
 163         CHAN4G(7, 2442, 0),
 164         CHAN4G(8, 2447, 0),
 165         CHAN4G(9, 2452, 0),
 166         CHAN4G(10, 2457, 0),
 167         CHAN4G(11, 2462, 0),
 168         CHAN4G(12, 2467, 0),
 169         CHAN4G(13, 2472, 0),
 170         CHAN4G(14, 2484, 0),
 171 };
 172 #undef CHAN4G
 173
 174 #define CHAN5G(_channel, _flags) {                              \
 175         .band                   = IEEE80211_BAND_5GHZ,          \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .flags                  = (_flags),                     \
 179         .max_antenna_gain       = 0,                            \
 180         .max_power              = 30,                           \
 181 }
 182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 183         CHAN5G(32, 0),          CHAN5G(34, 0),
 184         CHAN5G(36, 0),          CHAN5G(38, 0),
 185         CHAN5G(40, 0),          CHAN5G(42, 0),
 186         CHAN5G(44, 0),          CHAN5G(46, 0),
 187         CHAN5G(48, 0),          CHAN5G(50, 0),
 188         CHAN5G(52, 0),          CHAN5G(54, 0),
 189         CHAN5G(56, 0),          CHAN5G(58, 0),
 190         CHAN5G(60, 0),          CHAN5G(62, 0),
 191         CHAN5G(64, 0),          CHAN5G(66, 0),
 192         CHAN5G(68, 0),          CHAN5G(70, 0),
 193         CHAN5G(72, 0),          CHAN5G(74, 0),
 194         CHAN5G(76, 0),          CHAN5G(78, 0),
 195         CHAN5G(80, 0),          CHAN5G(82, 0),
 196         CHAN5G(84, 0),          CHAN5G(86, 0),
 197         CHAN5G(88, 0),          CHAN5G(90, 0),
 198         CHAN5G(92, 0),          CHAN5G(94, 0),
 199         CHAN5G(96, 0),          CHAN5G(98, 0),
 200         CHAN5G(100, 0),         CHAN5G(102, 0),
 201         CHAN5G(104, 0),         CHAN5G(106, 0),
 202         CHAN5G(108, 0),         CHAN5G(110, 0),
 203         CHAN5G(112, 0),         CHAN5G(114, 0),
 204         CHAN5G(116, 0),         CHAN5G(118, 0),
 205         CHAN5G(120, 0),         CHAN5G(122, 0),
 206         CHAN5G(124, 0),         CHAN5G(126, 0),
 207         CHAN5G(128, 0),         CHAN5G(130, 0),
 208         CHAN5G(132, 0),         CHAN5G(134, 0),
 209         CHAN5G(136, 0),         CHAN5G(138, 0),
 210         CHAN5G(140, 0),         CHAN5G(142, 0),
 211         CHAN5G(144, 0),         CHAN5G(145, 0),
 212         CHAN5G(146, 0),         CHAN5G(147, 0),
 213         CHAN5G(148, 0),         CHAN5G(149, 0),
 214         CHAN5G(150, 0),         CHAN5G(151, 0),
 215         CHAN5G(152, 0),         CHAN5G(153, 0),
 216         CHAN5G(154, 0),         CHAN5G(155, 0),
 217         CHAN5G(156, 0),         CHAN5G(157, 0),
 218         CHAN5G(158, 0),         CHAN5G(159, 0),
 219         CHAN5G(160, 0),         CHAN5G(161, 0),
 220         CHAN5G(162, 0),         CHAN5G(163, 0),
 221         CHAN5G(164, 0),         CHAN5G(165, 0),
 222         CHAN5G(166, 0),         CHAN5G(168, 0),
 223         CHAN5G(170, 0),         CHAN5G(172, 0),
 224         CHAN5G(174, 0),         CHAN5G(176, 0),
 225         CHAN5G(178, 0),         CHAN5G(180, 0),
 226         CHAN5G(182, 0),         CHAN5G(184, 0),
 227         CHAN5G(186, 0),         CHAN5G(188, 0),
 228         CHAN5G(190, 0),         CHAN5G(192, 0),
 229         CHAN5G(194, 0),         CHAN5G(196, 0),
 230         CHAN5G(198, 0),         CHAN5G(200, 0),
 231         CHAN5G(202, 0),         CHAN5G(204, 0),
 232         CHAN5G(206, 0),         CHAN5G(208, 0),
 233         CHAN5G(210, 0),         CHAN5G(212, 0),
 234         CHAN5G(214, 0),         CHAN5G(216, 0),
 235         CHAN5G(218, 0),         CHAN5G(220, 0),
 236         CHAN5G(222, 0),         CHAN5G(224, 0),
 237         CHAN5G(226, 0),         CHAN5G(228, 0),
 238 };
 239
 240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 241         CHAN5G(34, 0),          CHAN5G(36, 0),
 242         CHAN5G(38, 0),          CHAN5G(40, 0),
 243         CHAN5G(42, 0),          CHAN5G(44, 0),
 244         CHAN5G(46, 0),          CHAN5G(48, 0),
 245         CHAN5G(52, 0),          CHAN5G(56, 0),
 246         CHAN5G(60, 0),          CHAN5G(64, 0),
 247         CHAN5G(100, 0),         CHAN5G(104, 0),
 248         CHAN5G(108, 0),         CHAN5G(112, 0),
 249         CHAN5G(116, 0),         CHAN5G(120, 0),
 250         CHAN5G(124, 0),         CHAN5G(128, 0),
 251         CHAN5G(132, 0),         CHAN5G(136, 0),
 252         CHAN5G(140, 0),         CHAN5G(149, 0),
 253         CHAN5G(153, 0),         CHAN5G(157, 0),
 254         CHAN5G(161, 0),         CHAN5G(165, 0),
 255         CHAN5G(184, 0),         CHAN5G(188, 0),
 256         CHAN5G(192, 0),         CHAN5G(196, 0),
 257         CHAN5G(200, 0),         CHAN5G(204, 0),
 258         CHAN5G(208, 0),         CHAN5G(212, 0),
 259         CHAN5G(216, 0),
 260 };
 261 #undef CHAN5G
 262
 263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 264         .band           = IEEE80211_BAND_5GHZ,
 265         .channels       = b43_5ghz_nphy_chantable,
 266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 267         .bitrates       = b43_a_ratetable,
 268         .n_bitrates     = b43_a_ratetable_size,
 269 };
 270
 271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 272         .band           = IEEE80211_BAND_5GHZ,
 273         .channels       = b43_5ghz_aphy_chantable,
 274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 275         .bitrates       = b43_a_ratetable,
 276         .n_bitrates     = b43_a_ratetable_size,
 277 };
 278
 279 static struct ieee80211_supported_band b43_band_2GHz = {
 280         .band           = IEEE80211_BAND_2GHZ,
 281         .channels       = b43_2ghz_chantable,
 282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 283         .bitrates       = b43_g_ratetable,
 284         .n_bitrates     = b43_g_ratetable_size,
 285 };
 286
 287 static void b43_wireless_core_exit(struct b43_wldev *dev);
 288 static int b43_wireless_core_init(struct b43_wldev *dev);
 289 static void b43_wireless_core_stop(struct b43_wldev *dev);
 290 static int b43_wireless_core_start(struct b43_wldev *dev);
 291
 292 static int b43_ratelimit(struct b43_wl *wl)
 293 {
 294         if (!wl || !wl->current_dev)
 295                 return 1;
 296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 297                 return 1;
 298         /* We are up and running.
 299          * Ratelimit the messages to avoid DoS over the net. */
 300         return net_ratelimit();
 301 }
 302
 303 void b43info(struct b43_wl *wl, const char *fmt, ...)
 304 {
 305         va_list args;
 306
 307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 308                 return;
 309         if (!b43_ratelimit(wl))
 310                 return;
 311         va_start(args, fmt);
 312         printk(KERN_INFO "b43-%s: ",
 313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 314         vprintk(fmt, args);
 315         va_end(args);
 316 }
 317
 318 void b43err(struct b43_wl *wl, const char *fmt, ...)
 319 {
 320         va_list args;
 321
 322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 323                 return;
 324         if (!b43_ratelimit(wl))
 325                 return;
 326         va_start(args, fmt);
 327         printk(KERN_ERR "b43-%s ERROR: ",
 328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 329         vprintk(fmt, args);
 330         va_end(args);
 331 }
 332
 333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 334 {
 335         va_list args;
 336
 337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 338                 return;
 339         if (!b43_ratelimit(wl))
 340                 return;
 341         va_start(args, fmt);
 342         printk(KERN_WARNING "b43-%s warning: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347
 348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 349 {
 350         va_list args;
 351
 352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 353                 return;
 354         va_start(args, fmt);
 355         printk(KERN_DEBUG "b43-%s debug: ",
 356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 357         vprintk(fmt, args);
 358         va_end(args);
 359 }
 360
 361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 362 {
 363         u32 macctl;
 364
 365         B43_WARN_ON(offset % 4 != 0);
 366
 367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 368         if (macctl & B43_MACCTL_BE)
 369                 val = swab32(val);
 370
 371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 372         mmiowb();
 373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 374 }
 375
 376 static inline void b43_shm_control_word(struct b43_wldev *dev,
 377                                         u16 routing, u16 offset)
 378 {
 379         u32 control;
 380
 381         /* "offset" is the WORD offset. */
 382         control = routing;
 383         control <<= 16;
 384         control |= offset;
 385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 386 }
 387
 388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 389 {
 390         u32 ret;
 391
 392         if (routing == B43_SHM_SHARED) {
 393                 B43_WARN_ON(offset & 0x0001);
 394                 if (offset & 0x0003) {
 395                         /* Unaligned access */
 396                         b43_shm_control_word(dev, routing, offset >> 2);
 397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 398                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 399                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 400
 401                         goto out;
 402                 }
 403                 offset >>= 2;
 404         }
 405         b43_shm_control_word(dev, routing, offset);
 406         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 407 out:
 408         return ret;
 409 }
 410
 411 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 412 {
 413         struct b43_wl *wl = dev->wl;
 414         unsigned long flags;
 415         u32 ret;
 416
 417         spin_lock_irqsave(&wl->shm_lock, flags);
 418         ret = __b43_shm_read32(dev, routing, offset);
 419         spin_unlock_irqrestore(&wl->shm_lock, flags);
 420
 421         return ret;
 422 }
 423
 424 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 425 {
 426         u16 ret;
 427
 428         if (routing == B43_SHM_SHARED) {
 429                 B43_WARN_ON(offset & 0x0001);
 430                 if (offset & 0x0003) {
 431                         /* Unaligned access */
 432                         b43_shm_control_word(dev, routing, offset >> 2);
 433                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 434
 435                         goto out;
 436                 }
 437                 offset >>= 2;
 438         }
 439         b43_shm_control_word(dev, routing, offset);
 440         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 441 out:
 442         return ret;
 443 }
 444
 445 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 446 {
 447         struct b43_wl *wl = dev->wl;
 448         unsigned long flags;
 449         u16 ret;
 450
 451         spin_lock_irqsave(&wl->shm_lock, flags);
 452         ret = __b43_shm_read16(dev, routing, offset);
 453         spin_unlock_irqrestore(&wl->shm_lock, flags);
 454
 455         return ret;
 456 }
 457
 458 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 459 {
 460         if (routing == B43_SHM_SHARED) {
 461                 B43_WARN_ON(offset & 0x0001);
 462                 if (offset & 0x0003) {
 463                         /* Unaligned access */
 464                         b43_shm_control_word(dev, routing, offset >> 2);
 465                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 466                                     value & 0xFFFF);
 467                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 468                         b43_write16(dev, B43_MMIO_SHM_DATA,
 469                                     (value >> 16) & 0xFFFF);
 470                         return;
 471                 }
 472                 offset >>= 2;
 473         }
 474         b43_shm_control_word(dev, routing, offset);
 475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 476 }
 477
 478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 479 {
 480         struct b43_wl *wl = dev->wl;
 481         unsigned long flags;
 482
 483         spin_lock_irqsave(&wl->shm_lock, flags);
 484         __b43_shm_write32(dev, routing, offset, value);
 485         spin_unlock_irqrestore(&wl->shm_lock, flags);
 486 }
 487
 488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 496                         return;
 497                 }
 498                 offset >>= 2;
 499         }
 500         b43_shm_control_word(dev, routing, offset);
 501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 502 }
 503
 504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 505 {
 506         struct b43_wl *wl = dev->wl;
 507         unsigned long flags;
 508
 509         spin_lock_irqsave(&wl->shm_lock, flags);
 510         __b43_shm_write16(dev, routing, offset, value);
 511         spin_unlock_irqrestore(&wl->shm_lock, flags);
 512 }
 513
 514 /* Read HostFlags */
 515 u64 b43_hf_read(struct b43_wldev *dev)
 516 {
 517         u64 ret;
 518
 519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 522         ret <<= 16;
 523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 524
 525         return ret;
 526 }
 527
 528 /* Write HostFlags */
 529 void b43_hf_write(struct b43_wldev *dev, u64 value)
 530 {
 531         u16 lo, mi, hi;
 532
 533         lo = (value & 0x00000000FFFFULL);
 534         mi = (value & 0x0000FFFF0000ULL) >> 16;
 535         hi = (value & 0xFFFF00000000ULL) >> 32;
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 539 }
 540
 541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 543 {
 544         B43_WARN_ON(!dev->fw.opensource);
 545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 546 }
 547
 548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 549 {
 550         u32 low, high;
 551
 552         B43_WARN_ON(dev->dev->id.revision < 3);
 553
 554         /* The hardware guarantees us an atomic read, if we
 555          * read the low register first. */
 556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 558
 559         *tsf = high;
 560         *tsf <<= 32;
 561         *tsf |= low;
 562 }
 563
 564 static void b43_time_lock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl |= B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_time_unlock(struct b43_wldev *dev)
 576 {
 577         u32 macctl;
 578
 579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 580         macctl &= ~B43_MACCTL_TBTTHOLD;
 581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 582         /* Commit the write */
 583         b43_read32(dev, B43_MMIO_MACCTL);
 584 }
 585
 586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 587 {
 588         u32 low, high;
 589
 590         B43_WARN_ON(dev->dev->id.revision < 3);
 591
 592         low = tsf;
 593         high = (tsf >> 32);
 594         /* The hardware guarantees us an atomic write, if we
 595          * write the low register first. */
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 597         mmiowb();
 598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 599         mmiowb();
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676 }
 677
 678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 20);
 681 }
 682
 683 /* Synchronize IRQ top- and bottom-half.
 684  * IRQs must be masked before calling this.
 685  * This must not be called with the irq_lock held.
 686  */
 687 static void b43_synchronize_irq(struct b43_wldev *dev)
 688 {
 689         synchronize_irq(dev->dev->irq);
 690         tasklet_kill(&dev->isr_tasklet);
 691 }
 692
 693 /* DummyTransmission function, as documented on
 694  * http://bcm-specs.sipsolutions.net/DummyTransmission
 695  */
 696 void b43_dummy_transmission(struct b43_wldev *dev)
 697 {
 698         struct b43_wl *wl = dev->wl;
 699         struct b43_phy *phy = &dev->phy;
 700         unsigned int i, max_loop;
 701         u16 value;
 702         u32 buffer[5] = {
 703                 0x00000000,
 704                 0x00D40000,
 705                 0x00000000,
 706                 0x01000000,
 707                 0x00000000,
 708         };
 709
 710         switch (phy->type) {
 711         case B43_PHYTYPE_A:
 712                 max_loop = 0x1E;
 713                 buffer[0] = 0x000201CC;
 714                 break;
 715         case B43_PHYTYPE_B:
 716         case B43_PHYTYPE_G:
 717                 max_loop = 0xFA;
 718                 buffer[0] = 0x000B846E;
 719                 break;
 720         default:
 721                 B43_WARN_ON(1);
 722                 return;
 723         }
 724
 725         spin_lock_irq(&wl->irq_lock);
 726         write_lock(&wl->tx_lock);
 727
 728         for (i = 0; i < 5; i++)
 729                 b43_ram_write(dev, i * 4, buffer[i]);
 730
 731         /* Commit writes */
 732         b43_read32(dev, B43_MMIO_MACCTL);
 733
 734         b43_write16(dev, 0x0568, 0x0000);
 735         b43_write16(dev, 0x07C0, 0x0000);
 736         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 737         b43_write16(dev, 0x050C, value);
 738         b43_write16(dev, 0x0508, 0x0000);
 739         b43_write16(dev, 0x050A, 0x0000);
 740         b43_write16(dev, 0x054C, 0x0000);
 741         b43_write16(dev, 0x056A, 0x0014);
 742         b43_write16(dev, 0x0568, 0x0826);
 743         b43_write16(dev, 0x0500, 0x0000);
 744         b43_write16(dev, 0x0502, 0x0030);
 745
 746         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 747                 b43_radio_write16(dev, 0x0051, 0x0017);
 748         for (i = 0x00; i < max_loop; i++) {
 749                 value = b43_read16(dev, 0x050E);
 750                 if (value & 0x0080)
 751                         break;
 752                 udelay(10);
 753         }
 754         for (i = 0x00; i < 0x0A; i++) {
 755                 value = b43_read16(dev, 0x050E);
 756                 if (value & 0x0400)
 757                         break;
 758                 udelay(10);
 759         }
 760         for (i = 0x00; i < 0x19; i++) {
 761                 value = b43_read16(dev, 0x0690);
 762                 if (!(value & 0x0100))
 763                         break;
 764                 udelay(10);
 765         }
 766         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 767                 b43_radio_write16(dev, 0x0051, 0x0037);
 768
 769         write_unlock(&wl->tx_lock);
 770         spin_unlock_irq(&wl->irq_lock);
 771 }
 772
 773 static void key_write(struct b43_wldev *dev,
 774                       u8 index, u8 algorithm, const u8 *key)
 775 {
 776         unsigned int i;
 777         u32 offset;
 778         u16 value;
 779         u16 kidx;
 780
 781         /* Key index/algo block */
 782         kidx = b43_kidx_to_fw(dev, index);
 783         value = ((kidx << 4) | algorithm);
 784         b43_shm_write16(dev, B43_SHM_SHARED,
 785                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 786
 787         /* Write the key to the Key Table Pointer offset */
 788         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 789         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 790                 value = key[i];
 791                 value |= (u16) (key[i + 1]) << 8;
 792                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 793         }
 794 }
 795
 796 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 797 {
 798         u32 addrtmp[2] = { 0, 0, };
 799         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 800
 801         if (b43_new_kidx_api(dev))
 802                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 803
 804         B43_WARN_ON(index < pairwise_keys_start);
 805         /* We have four default TX keys and possibly four default RX keys.
 806          * Physical mac 0 is mapped to physical key 4 or 8, depending
 807          * on the firmware version.
 808          * So we must adjust the index here.
 809          */
 810         index -= pairwise_keys_start;
 811         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 812
 813         if (addr) {
 814                 addrtmp[0] = addr[0];
 815                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 816                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 817                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 818                 addrtmp[1] = addr[4];
 819                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 820         }
 821
 822         /* Receive match transmitter address (RCMTA) mechanism */
 823         b43_shm_write32(dev, B43_SHM_RCMTA,
 824                         (index * 2) + 0, addrtmp[0]);
 825         b43_shm_write16(dev, B43_SHM_RCMTA,
 826                         (index * 2) + 1, addrtmp[1]);
 827 }
 828
 829 static void do_key_write(struct b43_wldev *dev,
 830                          u8 index, u8 algorithm,
 831                          const u8 *key, size_t key_len, const u8 *mac_addr)
 832 {
 833         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 834         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 835
 836         if (b43_new_kidx_api(dev))
 837                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 838
 839         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 840         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 841
 842         if (index >= pairwise_keys_start)
 843                 keymac_write(dev, index, NULL); /* First zero out mac. */
 844         if (key)
 845                 memcpy(buf, key, key_len);
 846         key_write(dev, index, algorithm, buf);
 847         if (index >= pairwise_keys_start)
 848                 keymac_write(dev, index, mac_addr);
 849
 850         dev->key[index].algorithm = algorithm;
 851 }
 852
 853 static int b43_key_write(struct b43_wldev *dev,
 854                          int index, u8 algorithm,
 855                          const u8 *key, size_t key_len,
 856                          const u8 *mac_addr,
 857                          struct ieee80211_key_conf *keyconf)
 858 {
 859         int i;
 860         int pairwise_keys_start;
 861
 862         if (key_len > B43_SEC_KEYSIZE)
 863                 return -EINVAL;
 864         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 865                 /* Check that we don't already have this key. */
 866                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 867         }
 868         if (index < 0) {
 869                 /* Pairwise key. Get an empty slot for the key. */
 870                 if (b43_new_kidx_api(dev))
 871                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 872                 else
 873                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 874                 for (i = pairwise_keys_start;
 875                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 876                      i++) {
 877                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 878                         if (!dev->key[i].keyconf) {
 879                                 /* found empty */
 880                                 index = i;
 881                                 break;
 882                         }
 883                 }
 884                 if (index < 0) {
 885                         b43warn(dev->wl, "Out of hardware key memory\n");
 886                         return -ENOSPC;
 887                 }
 888         } else
 889                 B43_WARN_ON(index > 3);
 890
 891         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 892         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 893                 /* Default RX key */
 894                 B43_WARN_ON(mac_addr);
 895                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 896         }
 897         keyconf->hw_key_idx = index;
 898         dev->key[index].keyconf = keyconf;
 899
 900         return 0;
 901 }
 902
 903 static int b43_key_clear(struct b43_wldev *dev, int index)
 904 {
 905         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 906                 return -EINVAL;
 907         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 908                      NULL, B43_SEC_KEYSIZE, NULL);
 909         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 910                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 911                              NULL, B43_SEC_KEYSIZE, NULL);
 912         }
 913         dev->key[index].keyconf = NULL;
 914
 915         return 0;
 916 }
 917
 918 static void b43_clear_keys(struct b43_wldev *dev)
 919 {
 920         int i, count;
 921
 922         if (b43_new_kidx_api(dev))
 923                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 924         else
 925                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 926         for (i = 0; i < count; i++)
 927                 b43_key_clear(dev, i);
 928 }
 929
 930 static void b43_dump_keymemory(struct b43_wldev *dev)
 931 {
 932         unsigned int i, index, count, offset, pairwise_keys_start;
 933         u8 mac[ETH_ALEN];
 934         u16 algo;
 935         u32 rcmta0;
 936         u16 rcmta1;
 937         u64 hf;
 938         struct b43_key *key;
 939
 940         if (!b43_debug(dev, B43_DBG_KEYS))
 941                 return;
 942
 943         hf = b43_hf_read(dev);
 944         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 945                !!(hf & B43_HF_USEDEFKEYS));
 946         if (b43_new_kidx_api(dev)) {
 947                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 948                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 949         } else {
 950                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 951                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 952         }
 953         for (index = 0; index < count; index++) {
 954                 key = &(dev->key[index]);
 955                 printk(KERN_DEBUG "Key slot %02u: %s",
 956                        index, (key->keyconf == NULL) ? " " : "*");
 957                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 958                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 959                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 960                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 961                 }
 962
 963                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 964                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 965                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 966
 967                 if (index >= pairwise_keys_start) {
 968                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 969                                                 ((index - pairwise_keys_start) * 2) + 0);
 970                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 971                                                 ((index - pairwise_keys_start) * 2) + 1);
 972                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 973                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 974                         printk("   MAC: %pM", mac);
 975                 } else
 976                         printk("   DEFAULT KEY");
 977                 printk("\n");
 978         }
 979 }
 980
 981 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 982 {
 983         u32 macctl;
 984         u16 ucstat;
 985         bool hwps;
 986         bool awake;
 987         int i;
 988
 989         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 990                     (ps_flags & B43_PS_DISABLED));
 991         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
 992
 993         if (ps_flags & B43_PS_ENABLED) {
 994                 hwps = 1;
 995         } else if (ps_flags & B43_PS_DISABLED) {
 996                 hwps = 0;
 997         } else {
 998                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
 999                 //      and thus is not an AP and we are associated, set bit 25
1000         }
1001         if (ps_flags & B43_PS_AWAKE) {
1002                 awake = 1;
1003         } else if (ps_flags & B43_PS_ASLEEP) {
1004                 awake = 0;
1005         } else {
1006                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1007                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1008                 //      successful, set bit26
1009         }
1010
1011 /* FIXME: For now we force awake-on and hwps-off */
1012         hwps = 0;
1013         awake = 1;
1014
1015         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1016         if (hwps)
1017                 macctl |= B43_MACCTL_HWPS;
1018         else
1019                 macctl &= ~B43_MACCTL_HWPS;
1020         if (awake)
1021                 macctl |= B43_MACCTL_AWAKE;
1022         else
1023                 macctl &= ~B43_MACCTL_AWAKE;
1024         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1025         /* Commit write */
1026         b43_read32(dev, B43_MMIO_MACCTL);
1027         if (awake && dev->dev->id.revision >= 5) {
1028                 /* Wait for the microcode to wake up. */
1029                 for (i = 0; i < 100; i++) {
1030                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1031                                                 B43_SHM_SH_UCODESTAT);
1032                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1033                                 break;
1034                         udelay(10);
1035                 }
1036         }
1037 }
1038
1039 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1040 {
1041         u32 tmslow;
1042         u32 macctl;
1043
1044         flags |= B43_TMSLOW_PHYCLKEN;
1045         flags |= B43_TMSLOW_PHYRESET;
1046         ssb_device_enable(dev->dev, flags);
1047         msleep(2);              /* Wait for the PLL to turn on. */
1048
1049         /* Now take the PHY out of Reset again */
1050         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1051         tmslow |= SSB_TMSLOW_FGC;
1052         tmslow &= ~B43_TMSLOW_PHYRESET;
1053         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1054         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1055         msleep(1);
1056         tmslow &= ~SSB_TMSLOW_FGC;
1057         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1058         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1059         msleep(1);
1060
1061         /* Turn Analog ON, but only if we already know the PHY-type.
1062          * This protects against very early setup where we don't know the
1063          * PHY-type, yet. wireless_core_reset will be called once again later,
1064          * when we know the PHY-type. */
1065         if (dev->phy.ops)
1066                 dev->phy.ops->switch_analog(dev, 1);
1067
1068         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1069         macctl &= ~B43_MACCTL_GMODE;
1070         if (flags & B43_TMSLOW_GMODE)
1071                 macctl |= B43_MACCTL_GMODE;
1072         macctl |= B43_MACCTL_IHR_ENABLED;
1073         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1074 }
1075
1076 static void handle_irq_transmit_status(struct b43_wldev *dev)
1077 {
1078         u32 v0, v1;
1079         u16 tmp;
1080         struct b43_txstatus stat;
1081
1082         while (1) {
1083                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1084                 if (!(v0 & 0x00000001))
1085                         break;
1086                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1087
1088                 stat.cookie = (v0 >> 16);
1089                 stat.seq = (v1 & 0x0000FFFF);
1090                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1091                 tmp = (v0 & 0x0000FFFF);
1092                 stat.frame_count = ((tmp & 0xF000) >> 12);
1093                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1094                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1095                 stat.pm_indicated = !!(tmp & 0x0080);
1096                 stat.intermediate = !!(tmp & 0x0040);
1097                 stat.for_ampdu = !!(tmp & 0x0020);
1098                 stat.acked = !!(tmp & 0x0002);
1099
1100                 b43_handle_txstatus(dev, &stat);
1101         }
1102 }
1103
1104 static void drain_txstatus_queue(struct b43_wldev *dev)
1105 {
1106         u32 dummy;
1107
1108         if (dev->dev->id.revision < 5)
1109                 return;
1110         /* Read all entries from the microcode TXstatus FIFO
1111          * and throw them away.
1112          */
1113         while (1) {
1114                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1115                 if (!(dummy & 0x00000001))
1116                         break;
1117                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1118         }
1119 }
1120
1121 static u32 b43_jssi_read(struct b43_wldev *dev)
1122 {
1123         u32 val = 0;
1124
1125         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1126         val <<= 16;
1127         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1128
1129         return val;
1130 }
1131
1132 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1133 {
1134         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1135         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1136 }
1137
1138 static void b43_generate_noise_sample(struct b43_wldev *dev)
1139 {
1140         b43_jssi_write(dev, 0x7F7F7F7F);
1141         b43_write32(dev, B43_MMIO_MACCMD,
1142                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1143 }
1144
1145 static void b43_calculate_link_quality(struct b43_wldev *dev)
1146 {
1147         /* Top half of Link Quality calculation. */
1148
1149         if (dev->phy.type != B43_PHYTYPE_G)
1150                 return;
1151         if (dev->noisecalc.calculation_running)
1152                 return;
1153         dev->noisecalc.calculation_running = 1;
1154         dev->noisecalc.nr_samples = 0;
1155
1156         b43_generate_noise_sample(dev);
1157 }
1158
1159 static void handle_irq_noise(struct b43_wldev *dev)
1160 {
1161         struct b43_phy_g *phy = dev->phy.g;
1162         u16 tmp;
1163         u8 noise[4];
1164         u8 i, j;
1165         s32 average;
1166
1167         /* Bottom half of Link Quality calculation. */
1168
1169         if (dev->phy.type != B43_PHYTYPE_G)
1170                 return;
1171
1172         /* Possible race condition: It might be possible that the user
1173          * changed to a different channel in the meantime since we
1174          * started the calculation. We ignore that fact, since it's
1175          * not really that much of a problem. The background noise is
1176          * an estimation only anyway. Slightly wrong results will get damped
1177          * by the averaging of the 8 sample rounds. Additionally the
1178          * value is shortlived. So it will be replaced by the next noise
1179          * calculation round soon. */
1180
1181         B43_WARN_ON(!dev->noisecalc.calculation_running);
1182         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1183         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1184             noise[2] == 0x7F || noise[3] == 0x7F)
1185                 goto generate_new;
1186
1187         /* Get the noise samples. */
1188         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1189         i = dev->noisecalc.nr_samples;
1190         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1191         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1192         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1193         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1194         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1195         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1196         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1197         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1198         dev->noisecalc.nr_samples++;
1199         if (dev->noisecalc.nr_samples == 8) {
1200                 /* Calculate the Link Quality by the noise samples. */
1201                 average = 0;
1202                 for (i = 0; i < 8; i++) {
1203                         for (j = 0; j < 4; j++)
1204                                 average += dev->noisecalc.samples[i][j];
1205                 }
1206                 average /= (8 * 4);
1207                 average *= 125;
1208                 average += 64;
1209                 average /= 128;
1210                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1211                 tmp = (tmp / 128) & 0x1F;
1212                 if (tmp >= 8)
1213                         average += 2;
1214                 else
1215                         average -= 25;
1216                 if (tmp == 8)
1217                         average -= 72;
1218                 else
1219                         average -= 48;
1220
1221                 dev->stats.link_noise = average;
1222                 dev->noisecalc.calculation_running = 0;
1223                 return;
1224         }
1225 generate_new:
1226         b43_generate_noise_sample(dev);
1227 }
1228
1229 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1230 {
1231         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1232                 ///TODO: PS TBTT
1233         } else {
1234                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1235                         b43_power_saving_ctl_bits(dev, 0);
1236         }
1237         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1238                 dev->dfq_valid = 1;
1239 }
1240
1241 static void handle_irq_atim_end(struct b43_wldev *dev)
1242 {
1243         if (dev->dfq_valid) {
1244                 b43_write32(dev, B43_MMIO_MACCMD,
1245                             b43_read32(dev, B43_MMIO_MACCMD)
1246                             | B43_MACCMD_DFQ_VALID);
1247                 dev->dfq_valid = 0;
1248         }
1249 }
1250
1251 static void handle_irq_pmq(struct b43_wldev *dev)
1252 {
1253         u32 tmp;
1254
1255         //TODO: AP mode.
1256
1257         while (1) {
1258                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1259                 if (!(tmp & 0x00000008))
1260                         break;
1261         }
1262         /* 16bit write is odd, but correct. */
1263         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1264 }
1265
1266 static void b43_write_template_common(struct b43_wldev *dev,
1267                                       const u8 *data, u16 size,
1268                                       u16 ram_offset,
1269                                       u16 shm_size_offset, u8 rate)
1270 {
1271         u32 i, tmp;
1272         struct b43_plcp_hdr4 plcp;
1273
1274         plcp.data = 0;
1275         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1276         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1277         ram_offset += sizeof(u32);
1278         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1279          * So leave the first two bytes of the next write blank.
1280          */
1281         tmp = (u32) (data[0]) << 16;
1282         tmp |= (u32) (data[1]) << 24;
1283         b43_ram_write(dev, ram_offset, tmp);
1284         ram_offset += sizeof(u32);
1285         for (i = 2; i < size; i += sizeof(u32)) {
1286                 tmp = (u32) (data[i + 0]);
1287                 if (i + 1 < size)
1288                         tmp |= (u32) (data[i + 1]) << 8;
1289                 if (i + 2 < size)
1290                         tmp |= (u32) (data[i + 2]) << 16;
1291                 if (i + 3 < size)
1292                         tmp |= (u32) (data[i + 3]) << 24;
1293                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1294         }
1295         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1296                         size + sizeof(struct b43_plcp_hdr6));
1297 }
1298
1299 /* Check if the use of the antenna that ieee80211 told us to
1300  * use is possible. This will fall back to DEFAULT.
1301  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1302 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1303                                   u8 antenna_nr)
1304 {
1305         u8 antenna_mask;
1306
1307         if (antenna_nr == 0) {
1308                 /* Zero means "use default antenna". That's always OK. */
1309                 return 0;
1310         }
1311
1312         /* Get the mask of available antennas. */
1313         if (dev->phy.gmode)
1314                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1315         else
1316                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1317
1318         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1319                 /* This antenna is not available. Fall back to default. */
1320                 return 0;
1321         }
1322
1323         return antenna_nr;
1324 }
1325
1326 /* Convert a b43 antenna number value to the PHY TX control value. */
1327 static u16 b43_antenna_to_phyctl(int antenna)
1328 {
1329         switch (antenna) {
1330         case B43_ANTENNA0:
1331                 return B43_TXH_PHY_ANT0;
1332         case B43_ANTENNA1:
1333                 return B43_TXH_PHY_ANT1;
1334         case B43_ANTENNA2:
1335                 return B43_TXH_PHY_ANT2;
1336         case B43_ANTENNA3:
1337                 return B43_TXH_PHY_ANT3;
1338         case B43_ANTENNA_AUTO:
1339                 return B43_TXH_PHY_ANT01AUTO;
1340         }
1341         B43_WARN_ON(1);
1342         return 0;
1343 }
1344
1345 static void b43_write_beacon_template(struct b43_wldev *dev,
1346                                       u16 ram_offset,
1347                                       u16 shm_size_offset)
1348 {
1349         unsigned int i, len, variable_len;
1350         const struct ieee80211_mgmt *bcn;
1351         const u8 *ie;
1352         bool tim_found = 0;
1353         unsigned int rate;
1354         u16 ctl;
1355         int antenna;
1356         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1357
1358         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1359         len = min((size_t) dev->wl->current_beacon->len,
1360                   0x200 - sizeof(struct b43_plcp_hdr6));
1361         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1362
1363         b43_write_template_common(dev, (const u8 *)bcn,
1364                                   len, ram_offset, shm_size_offset, rate);
1365
1366         /* Write the PHY TX control parameters. */
1367         antenna = B43_ANTENNA_DEFAULT;
1368         antenna = b43_antenna_to_phyctl(antenna);
1369         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1370         /* We can't send beacons with short preamble. Would get PHY errors. */
1371         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1372         ctl &= ~B43_TXH_PHY_ANT;
1373         ctl &= ~B43_TXH_PHY_ENC;
1374         ctl |= antenna;
1375         if (b43_is_cck_rate(rate))
1376                 ctl |= B43_TXH_PHY_ENC_CCK;
1377         else
1378                 ctl |= B43_TXH_PHY_ENC_OFDM;
1379         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1380
1381         /* Find the position of the TIM and the DTIM_period value
1382          * and write them to SHM. */
1383         ie = bcn->u.beacon.variable;
1384         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1385         for (i = 0; i < variable_len - 2; ) {
1386                 uint8_t ie_id, ie_len;
1387
1388                 ie_id = ie[i];
1389                 ie_len = ie[i + 1];
1390                 if (ie_id == 5) {
1391                         u16 tim_position;
1392                         u16 dtim_period;
1393                         /* This is the TIM Information Element */
1394
1395                         /* Check whether the ie_len is in the beacon data range. */
1396                         if (variable_len < ie_len + 2 + i)
1397                                 break;
1398                         /* A valid TIM is at least 4 bytes long. */
1399                         if (ie_len < 4)
1400                                 break;
1401                         tim_found = 1;
1402
1403                         tim_position = sizeof(struct b43_plcp_hdr6);
1404                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1405                         tim_position += i;
1406
1407                         dtim_period = ie[i + 3];
1408
1409                         b43_shm_write16(dev, B43_SHM_SHARED,
1410                                         B43_SHM_SH_TIMBPOS, tim_position);
1411                         b43_shm_write16(dev, B43_SHM_SHARED,
1412                                         B43_SHM_SH_DTIMPER, dtim_period);
1413                         break;
1414                 }
1415                 i += ie_len + 2;
1416         }
1417         if (!tim_found) {
1418                 /*
1419                  * If ucode wants to modify TIM do it behind the beacon, this
1420                  * will happen, for example, when doing mesh networking.
1421                  */
1422                 b43_shm_write16(dev, B43_SHM_SHARED,
1423                                 B43_SHM_SH_TIMBPOS,
1424                                 len + sizeof(struct b43_plcp_hdr6));
1425                 b43_shm_write16(dev, B43_SHM_SHARED,
1426                                 B43_SHM_SH_DTIMPER, 0);
1427         }
1428         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1429 }
1430
1431 static void b43_upload_beacon0(struct b43_wldev *dev)
1432 {
1433         struct b43_wl *wl = dev->wl;
1434
1435         if (wl->beacon0_uploaded)
1436                 return;
1437         b43_write_beacon_template(dev, 0x68, 0x18);
1438         wl->beacon0_uploaded = 1;
1439 }
1440
1441 static void b43_upload_beacon1(struct b43_wldev *dev)
1442 {
1443         struct b43_wl *wl = dev->wl;
1444
1445         if (wl->beacon1_uploaded)
1446                 return;
1447         b43_write_beacon_template(dev, 0x468, 0x1A);
1448         wl->beacon1_uploaded = 1;
1449 }
1450
1451 static void handle_irq_beacon(struct b43_wldev *dev)
1452 {
1453         struct b43_wl *wl = dev->wl;
1454         u32 cmd, beacon0_valid, beacon1_valid;
1455
1456         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1457             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1458                 return;
1459
1460         /* This is the bottom half of the asynchronous beacon update. */
1461
1462         /* Ignore interrupt in the future. */
1463         dev->irq_mask &= ~B43_IRQ_BEACON;
1464
1465         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1466         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1467         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1468
1469         /* Schedule interrupt manually, if busy. */
1470         if (beacon0_valid && beacon1_valid) {
1471                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1472                 dev->irq_mask |= B43_IRQ_BEACON;
1473                 return;
1474         }
1475
1476         if (unlikely(wl->beacon_templates_virgin)) {
1477                 /* We never uploaded a beacon before.
1478                  * Upload both templates now, but only mark one valid. */
1479                 wl->beacon_templates_virgin = 0;
1480                 b43_upload_beacon0(dev);
1481                 b43_upload_beacon1(dev);
1482                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1483                 cmd |= B43_MACCMD_BEACON0_VALID;
1484                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1485         } else {
1486                 if (!beacon0_valid) {
1487                         b43_upload_beacon0(dev);
1488                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1489                         cmd |= B43_MACCMD_BEACON0_VALID;
1490                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1491                 } else if (!beacon1_valid) {
1492                         b43_upload_beacon1(dev);
1493                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1494                         cmd |= B43_MACCMD_BEACON1_VALID;
1495                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1496                 }
1497         }
1498 }
1499
1500 static void b43_beacon_update_trigger_work(struct work_struct *work)
1501 {
1502         struct b43_wl *wl = container_of(work, struct b43_wl,
1503                                          beacon_update_trigger);
1504         struct b43_wldev *dev;
1505
1506         mutex_lock(&wl->mutex);
1507         dev = wl->current_dev;
1508         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1509                 spin_lock_irq(&wl->irq_lock);
1510                 /* update beacon right away or defer to irq */
1511                 handle_irq_beacon(dev);
1512                 /* The handler might have updated the IRQ mask. */
1513                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1514                 mmiowb();
1515                 spin_unlock_irq(&wl->irq_lock);
1516         }
1517         mutex_unlock(&wl->mutex);
1518 }
1519
1520 /* Asynchronously update the packet templates in template RAM.
1521  * Locking: Requires wl->irq_lock to be locked. */
1522 static void b43_update_templates(struct b43_wl *wl)
1523 {
1524         struct sk_buff *beacon;
1525
1526         /* This is the top half of the ansynchronous beacon update.
1527          * The bottom half is the beacon IRQ.
1528          * Beacon update must be asynchronous to avoid sending an
1529          * invalid beacon. This can happen for example, if the firmware
1530          * transmits a beacon while we are updating it. */
1531
1532         /* We could modify the existing beacon and set the aid bit in
1533          * the TIM field, but that would probably require resizing and
1534          * moving of data within the beacon template.
1535          * Simply request a new beacon and let mac80211 do the hard work. */
1536         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1537         if (unlikely(!beacon))
1538                 return;
1539
1540         if (wl->current_beacon)
1541                 dev_kfree_skb_any(wl->current_beacon);
1542         wl->current_beacon = beacon;
1543         wl->beacon0_uploaded = 0;
1544         wl->beacon1_uploaded = 0;
1545         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1546 }
1547
1548 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1549 {
1550         b43_time_lock(dev);
1551         if (dev->dev->id.revision >= 3) {
1552                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1553                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1554         } else {
1555                 b43_write16(dev, 0x606, (beacon_int >> 6));
1556                 b43_write16(dev, 0x610, beacon_int);
1557         }
1558         b43_time_unlock(dev);
1559         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1560 }
1561
1562 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1563 {
1564         u16 reason;
1565
1566         /* Read the register that contains the reason code for the panic. */
1567         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1568         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1569
1570         switch (reason) {
1571         default:
1572                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1573                 /* fallthrough */
1574         case B43_FWPANIC_DIE:
1575                 /* Do not restart the controller or firmware.
1576                  * The device is nonfunctional from now on.
1577                  * Restarting would result in this panic to trigger again,
1578                  * so we avoid that recursion. */
1579                 break;
1580         case B43_FWPANIC_RESTART:
1581                 b43_controller_restart(dev, "Microcode panic");
1582                 break;
1583         }
1584 }
1585
1586 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1587 {
1588         unsigned int i, cnt;
1589         u16 reason, marker_id, marker_line;
1590         __le16 *buf;
1591
1592         /* The proprietary firmware doesn't have this IRQ. */
1593         if (!dev->fw.opensource)
1594                 return;
1595
1596         /* Read the register that contains the reason code for this IRQ. */
1597         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1598
1599         switch (reason) {
1600         case B43_DEBUGIRQ_PANIC:
1601                 b43_handle_firmware_panic(dev);
1602                 break;
1603         case B43_DEBUGIRQ_DUMP_SHM:
1604                 if (!B43_DEBUG)
1605                         break; /* Only with driver debugging enabled. */
1606                 buf = kmalloc(4096, GFP_ATOMIC);
1607                 if (!buf) {
1608                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1609                         goto out;
1610                 }
1611                 for (i = 0; i < 4096; i += 2) {
1612                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1613                         buf[i / 2] = cpu_to_le16(tmp);
1614                 }
1615                 b43info(dev->wl, "Shared memory dump:\n");
1616                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1617                                16, 2, buf, 4096, 1);
1618                 kfree(buf);
1619                 break;
1620         case B43_DEBUGIRQ_DUMP_REGS:
1621                 if (!B43_DEBUG)
1622                         break; /* Only with driver debugging enabled. */
1623                 b43info(dev->wl, "Microcode register dump:\n");
1624                 for (i = 0, cnt = 0; i < 64; i++) {
1625                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1626                         if (cnt == 0)
1627                                 printk(KERN_INFO);
1628                         printk("r%02u: 0x%04X  ", i, tmp);
1629                         cnt++;
1630                         if (cnt == 6) {
1631                                 printk("\n");
1632                                 cnt = 0;
1633                         }
1634                 }
1635                 printk("\n");
1636                 break;
1637         case B43_DEBUGIRQ_MARKER:
1638                 if (!B43_DEBUG)
1639                         break; /* Only with driver debugging enabled. */
1640                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1641                                            B43_MARKER_ID_REG);
1642                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1643                                              B43_MARKER_LINE_REG);
1644                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1645                         "at line number %u\n",
1646                         marker_id, marker_line);
1647                 break;
1648         default:
1649                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1650                        reason);
1651         }
1652 out:
1653         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1654         b43_shm_write16(dev, B43_SHM_SCRATCH,
1655                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1656 }
1657
1658 /* Interrupt handler bottom-half */
1659 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1660 {
1661         u32 reason;
1662         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1663         u32 merged_dma_reason = 0;
1664         int i;
1665         unsigned long flags;
1666
1667         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1668
1669         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1670
1671         reason = dev->irq_reason;
1672         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1673                 dma_reason[i] = dev->dma_reason[i];
1674                 merged_dma_reason |= dma_reason[i];
1675         }
1676
1677         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1678                 b43err(dev->wl, "MAC transmission error\n");
1679
1680         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1681                 b43err(dev->wl, "PHY transmission error\n");
1682                 rmb();
1683                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1684                         atomic_set(&dev->phy.txerr_cnt,
1685                                    B43_PHY_TX_BADNESS_LIMIT);
1686                         b43err(dev->wl, "Too many PHY TX errors, "
1687                                         "restarting the controller\n");
1688                         b43_controller_restart(dev, "PHY TX errors");
1689                 }
1690         }
1691
1692         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1693                                           B43_DMAIRQ_NONFATALMASK))) {
1694                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1695                         b43err(dev->wl, "Fatal DMA error: "
1696                                "0x%08X, 0x%08X, 0x%08X, "
1697                                "0x%08X, 0x%08X, 0x%08X\n",
1698                                dma_reason[0], dma_reason[1],
1699                                dma_reason[2], dma_reason[3],
1700                                dma_reason[4], dma_reason[5]);
1701                         b43_controller_restart(dev, "DMA error");
1702                         mmiowb();
1703                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1704                         return;
1705                 }
1706                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1707                         b43err(dev->wl, "DMA error: "
1708                                "0x%08X, 0x%08X, 0x%08X, "
1709                                "0x%08X, 0x%08X, 0x%08X\n",
1710                                dma_reason[0], dma_reason[1],
1711                                dma_reason[2], dma_reason[3],
1712                                dma_reason[4], dma_reason[5]);
1713                 }
1714         }
1715
1716         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1717                 handle_irq_ucode_debug(dev);
1718         if (reason & B43_IRQ_TBTT_INDI)
1719                 handle_irq_tbtt_indication(dev);
1720         if (reason & B43_IRQ_ATIM_END)
1721                 handle_irq_atim_end(dev);
1722         if (reason & B43_IRQ_BEACON)
1723                 handle_irq_beacon(dev);
1724         if (reason & B43_IRQ_PMQ)
1725                 handle_irq_pmq(dev);
1726         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1727                 ;/* TODO */
1728         if (reason & B43_IRQ_NOISESAMPLE_OK)
1729                 handle_irq_noise(dev);
1730
1731         /* Check the DMA reason registers for received data. */
1732         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1733                 if (b43_using_pio_transfers(dev))
1734                         b43_pio_rx(dev->pio.rx_queue);
1735                 else
1736                         b43_dma_rx(dev->dma.rx_ring);
1737         }
1738         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1739         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1740         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1741         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1742         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1743
1744         if (reason & B43_IRQ_TX_OK)
1745                 handle_irq_transmit_status(dev);
1746
1747         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1748         mmiowb();
1749         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1750 }
1751
1752 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1753 {
1754         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1755
1756         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1757         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1758         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1759         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1760         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1761 /* Unused ring
1762         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1763 */
1764 }
1765
1766 /* Interrupt handler top-half */
1767 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1768 {
1769         irqreturn_t ret = IRQ_NONE;
1770         struct b43_wldev *dev = dev_id;
1771         u32 reason;
1772
1773         B43_WARN_ON(!dev);
1774
1775         spin_lock(&dev->wl->irq_lock);
1776
1777         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1778                 /* This can only happen on shared IRQ lines. */
1779                 goto out;
1780         }
1781         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1782         if (reason == 0xffffffff)       /* shared IRQ */
1783                 goto out;
1784         ret = IRQ_HANDLED;
1785         reason &= dev->irq_mask;
1786         if (!reason)
1787                 goto out;
1788
1789         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1790             & 0x0001DC00;
1791         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1792             & 0x0000DC00;
1793         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1794             & 0x0000DC00;
1795         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1796             & 0x0001DC00;
1797         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1798             & 0x0000DC00;
1799 /* Unused ring
1800         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1801             & 0x0000DC00;
1802 */
1803
1804         b43_interrupt_ack(dev, reason);
1805         /* disable all IRQs. They are enabled again in the bottom half. */
1806         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1807         /* save the reason code and call our bottom half. */
1808         dev->irq_reason = reason;
1809         tasklet_schedule(&dev->isr_tasklet);
1810 out:
1811         mmiowb();
1812         spin_unlock(&dev->wl->irq_lock);
1813
1814         return ret;
1815 }
1816
1817 void b43_do_release_fw(struct b43_firmware_file *fw)
1818 {
1819         release_firmware(fw->data);
1820         fw->data = NULL;
1821         fw->filename = NULL;
1822 }
1823
1824 static void b43_release_firmware(struct b43_wldev *dev)
1825 {
1826         b43_do_release_fw(&dev->fw.ucode);
1827         b43_do_release_fw(&dev->fw.pcm);
1828         b43_do_release_fw(&dev->fw.initvals);
1829         b43_do_release_fw(&dev->fw.initvals_band);
1830 }
1831
1832 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1833 {
1834         const char text[] =
1835                 "You must go to " \
1836                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1837                 "and download the correct firmware for this driver version. " \
1838                 "Please carefully read all instructions on this website.\n";
1839
1840         if (error)
1841                 b43err(wl, text);
1842         else
1843                 b43warn(wl, text);
1844 }
1845
1846 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1847                       const char *name,
1848                       struct b43_firmware_file *fw)
1849 {
1850         const struct firmware *blob;
1851         struct b43_fw_header *hdr;
1852         u32 size;
1853         int err;
1854
1855         if (!name) {
1856                 /* Don't fetch anything. Free possibly cached firmware. */
1857                 /* FIXME: We should probably keep it anyway, to save some headache
1858                  * on suspend/resume with multiband devices. */
1859                 b43_do_release_fw(fw);
1860                 return 0;
1861         }
1862         if (fw->filename) {
1863                 if ((fw->type == ctx->req_type) &&
1864                     (strcmp(fw->filename, name) == 0))
1865                         return 0; /* Already have this fw. */
1866                 /* Free the cached firmware first. */
1867                 /* FIXME: We should probably do this later after we successfully
1868                  * got the new fw. This could reduce headache with multiband devices.
1869                  * We could also redesign this to cache the firmware for all possible
1870                  * bands all the time. */
1871                 b43_do_release_fw(fw);
1872         }
1873
1874         switch (ctx->req_type) {
1875         case B43_FWTYPE_PROPRIETARY:
1876                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1877                          "b43%s/%s.fw",
1878                          modparam_fwpostfix, name);
1879                 break;
1880         case B43_FWTYPE_OPENSOURCE:
1881                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1882                          "b43-open%s/%s.fw",
1883                          modparam_fwpostfix, name);
1884                 break;
1885         default:
1886                 B43_WARN_ON(1);
1887                 return -ENOSYS;
1888         }
1889         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
1890         if (err == -ENOENT) {
1891                 snprintf(ctx->errors[ctx->req_type],
1892                          sizeof(ctx->errors[ctx->req_type]),
1893                          "Firmware file \"%s\" not found\n", ctx->fwname);
1894                 return err;
1895         } else if (err) {
1896                 snprintf(ctx->errors[ctx->req_type],
1897                          sizeof(ctx->errors[ctx->req_type]),
1898                          "Firmware file \"%s\" request failed (err=%d)\n",
1899                          ctx->fwname, err);
1900                 return err;
1901         }
1902         if (blob->size < sizeof(struct b43_fw_header))
1903                 goto err_format;
1904         hdr = (struct b43_fw_header *)(blob->data);
1905         switch (hdr->type) {
1906         case B43_FW_TYPE_UCODE:
1907         case B43_FW_TYPE_PCM:
1908                 size = be32_to_cpu(hdr->size);
1909                 if (size != blob->size - sizeof(struct b43_fw_header))
1910                         goto err_format;
1911                 /* fallthrough */
1912         case B43_FW_TYPE_IV:
1913                 if (hdr->ver != 1)
1914                         goto err_format;
1915                 break;
1916         default:
1917                 goto err_format;
1918         }
1919
1920         fw->data = blob;
1921         fw->filename = name;
1922         fw->type = ctx->req_type;
1923
1924         return 0;
1925
1926 err_format:
1927         snprintf(ctx->errors[ctx->req_type],
1928                  sizeof(ctx->errors[ctx->req_type]),
1929                  "Firmware file \"%s\" format error.\n", ctx->fwname);
1930         release_firmware(blob);
1931
1932         return -EPROTO;
1933 }
1934
1935 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
1936 {
1937         struct b43_wldev *dev = ctx->dev;
1938         struct b43_firmware *fw = &ctx->dev->fw;
1939         const u8 rev = ctx->dev->dev->id.revision;
1940         const char *filename;
1941         u32 tmshigh;
1942         int err;
1943
1944         /* Get microcode */
1945         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1946         if ((rev >= 5) && (rev <= 10))
1947                 filename = "ucode5";
1948         else if ((rev >= 11) && (rev <= 12))
1949                 filename = "ucode11";
1950         else if (rev >= 13)
1951                 filename = "ucode13";
1952         else
1953                 goto err_no_ucode;
1954         err = b43_do_request_fw(ctx, filename, &fw->ucode);
1955         if (err)
1956                 goto err_load;
1957
1958         /* Get PCM code */
1959         if ((rev >= 5) && (rev <= 10))
1960                 filename = "pcm5";
1961         else if (rev >= 11)
1962                 filename = NULL;
1963         else
1964                 goto err_no_pcm;
1965         fw->pcm_request_failed = 0;
1966         err = b43_do_request_fw(ctx, filename, &fw->pcm);
1967         if (err == -ENOENT) {
1968                 /* We did not find a PCM file? Not fatal, but
1969                  * core rev <= 10 must do without hwcrypto then. */
1970                 fw->pcm_request_failed = 1;
1971         } else if (err)
1972                 goto err_load;
1973
1974         /* Get initvals */
1975         switch (dev->phy.type) {
1976         case B43_PHYTYPE_A:
1977                 if ((rev >= 5) && (rev <= 10)) {
1978                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1979                                 filename = "a0g1initvals5";
1980                         else
1981                                 filename = "a0g0initvals5";
1982                 } else
1983                         goto err_no_initvals;
1984                 break;
1985         case B43_PHYTYPE_G:
1986                 if ((rev >= 5) && (rev <= 10))
1987                         filename = "b0g0initvals5";
1988                 else if (rev >= 13)
1989                         filename = "b0g0initvals13";
1990                 else
1991                         goto err_no_initvals;
1992                 break;
1993         case B43_PHYTYPE_N:
1994                 if ((rev >= 11) && (rev <= 12))
1995                         filename = "n0initvals11";
1996                 else
1997                         goto err_no_initvals;
1998                 break;
1999         default:
2000                 goto err_no_initvals;
2001         }
2002         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2003         if (err)
2004                 goto err_load;
2005
2006         /* Get bandswitch initvals */
2007         switch (dev->phy.type) {
2008         case B43_PHYTYPE_A:
2009                 if ((rev >= 5) && (rev <= 10)) {
2010                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2011                                 filename = "a0g1bsinitvals5";
2012                         else
2013                                 filename = "a0g0bsinitvals5";
2014                 } else if (rev >= 11)
2015                         filename = NULL;
2016                 else
2017                         goto err_no_initvals;
2018                 break;
2019         case B43_PHYTYPE_G:
2020                 if ((rev >= 5) && (rev <= 10))
2021                         filename = "b0g0bsinitvals5";
2022                 else if (rev >= 11)
2023                         filename = NULL;
2024                 else
2025                         goto err_no_initvals;
2026                 break;
2027         case B43_PHYTYPE_N:
2028                 if ((rev >= 11) && (rev <= 12))
2029                         filename = "n0bsinitvals11";
2030                 else
2031                         goto err_no_initvals;
2032                 break;
2033         default:
2034                 goto err_no_initvals;
2035         }
2036         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2037         if (err)
2038                 goto err_load;
2039
2040         return 0;
2041
2042 err_no_ucode:
2043         err = ctx->fatal_failure = -EOPNOTSUPP;
2044         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2045                "is required for your device (wl-core rev %u)\n", rev);
2046         goto error;
2047
2048 err_no_pcm:
2049         err = ctx->fatal_failure = -EOPNOTSUPP;
2050         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2051                "is required for your device (wl-core rev %u)\n", rev);
2052         goto error;
2053
2054 err_no_initvals:
2055         err = ctx->fatal_failure = -EOPNOTSUPP;
2056         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2057                "is required for your device (wl-core rev %u)\n", rev);
2058         goto error;
2059
2060 err_load:
2061         /* We failed to load this firmware image. The error message
2062          * already is in ctx->errors. Return and let our caller decide
2063          * what to do. */
2064         goto error;
2065
2066 error:
2067         b43_release_firmware(dev);
2068         return err;
2069 }
2070
2071 static int b43_request_firmware(struct b43_wldev *dev)
2072 {
2073         struct b43_request_fw_context *ctx;
2074         unsigned int i;
2075         int err;
2076         const char *errmsg;
2077
2078         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2079         if (!ctx)
2080                 return -ENOMEM;
2081         ctx->dev = dev;
2082
2083         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2084         err = b43_try_request_fw(ctx);
2085         if (!err)
2086                 goto out; /* Successfully loaded it. */
2087         err = ctx->fatal_failure;
2088         if (err)
2089                 goto out;
2090
2091         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2092         err = b43_try_request_fw(ctx);
2093         if (!err)
2094                 goto out; /* Successfully loaded it. */
2095         err = ctx->fatal_failure;
2096         if (err)
2097                 goto out;
2098
2099         /* Could not find a usable firmware. Print the errors. */
2100         for (i = 0; i < B43_NR_FWTYPES; i++) {
2101                 errmsg = ctx->errors[i];
2102                 if (strlen(errmsg))
2103                         b43err(dev->wl, errmsg);
2104         }
2105         b43_print_fw_helptext(dev->wl, 1);
2106         err = -ENOENT;
2107
2108 out:
2109         kfree(ctx);
2110         return err;
2111 }
2112
2113 static int b43_upload_microcode(struct b43_wldev *dev)
2114 {
2115         const size_t hdr_len = sizeof(struct b43_fw_header);
2116         const __be32 *data;
2117         unsigned int i, len;
2118         u16 fwrev, fwpatch, fwdate, fwtime;
2119         u32 tmp, macctl;
2120         int err = 0;
2121
2122         /* Jump the microcode PSM to offset 0 */
2123         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2124         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2125         macctl |= B43_MACCTL_PSM_JMP0;
2126         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2127         /* Zero out all microcode PSM registers and shared memory. */
2128         for (i = 0; i < 64; i++)
2129                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2130         for (i = 0; i < 4096; i += 2)
2131                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2132
2133         /* Upload Microcode. */
2134         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2135         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2136         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2137         for (i = 0; i < len; i++) {
2138                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2139                 udelay(10);
2140         }
2141
2142         if (dev->fw.pcm.data) {
2143                 /* Upload PCM data. */
2144                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2145                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2146                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2147                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2148                 /* No need for autoinc bit in SHM_HW */
2149                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2150                 for (i = 0; i < len; i++) {
2151                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2152                         udelay(10);
2153                 }
2154         }
2155
2156         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2157
2158         /* Start the microcode PSM */
2159         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2160         macctl &= ~B43_MACCTL_PSM_JMP0;
2161         macctl |= B43_MACCTL_PSM_RUN;
2162         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2163
2164         /* Wait for the microcode to load and respond */
2165         i = 0;
2166         while (1) {
2167                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2168                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2169                         break;
2170                 i++;
2171                 if (i >= 20) {
2172                         b43err(dev->wl, "Microcode not responding\n");
2173                         b43_print_fw_helptext(dev->wl, 1);
2174                         err = -ENODEV;
2175                         goto error;
2176                 }
2177                 msleep_interruptible(50);
2178                 if (signal_pending(current)) {
2179                         err = -EINTR;
2180                         goto error;
2181                 }
2182         }
2183         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2184
2185         /* Get and check the revisions. */
2186         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2187         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2188         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2189         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2190
2191         if (fwrev <= 0x128) {
2192                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2193                        "binary drivers older than version 4.x is unsupported. "
2194                        "You must upgrade your firmware files.\n");
2195                 b43_print_fw_helptext(dev->wl, 1);
2196                 err = -EOPNOTSUPP;
2197                 goto error;
2198         }
2199         dev->fw.rev = fwrev;
2200         dev->fw.patch = fwpatch;
2201         dev->fw.opensource = (fwdate == 0xFFFF);
2202
2203         /* Default to use-all-queues. */
2204         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2205         dev->qos_enabled = !!modparam_qos;
2206         /* Default to firmware/hardware crypto acceleration. */
2207         dev->hwcrypto_enabled = 1;
2208
2209         if (dev->fw.opensource) {
2210                 u16 fwcapa;
2211
2212                 /* Patchlevel info is encoded in the "time" field. */
2213                 dev->fw.patch = fwtime;
2214                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2215                         dev->fw.rev, dev->fw.patch);
2216
2217                 fwcapa = b43_fwcapa_read(dev);
2218                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2219                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2220                         /* Disable hardware crypto and fall back to software crypto. */
2221                         dev->hwcrypto_enabled = 0;
2222                 }
2223                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2224                         b43info(dev->wl, "QoS not supported by firmware\n");
2225                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2226                          * ieee80211_unregister to make sure the networking core can
2227                          * properly free possible resources. */
2228                         dev->wl->hw->queues = 1;
2229                         dev->qos_enabled = 0;
2230                 }
2231         } else {
2232                 b43info(dev->wl, "Loading firmware version %u.%u "
2233                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2234                         fwrev, fwpatch,
2235                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2236                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2237                 if (dev->fw.pcm_request_failed) {
2238                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2239                                 "Hardware accelerated cryptography is disabled.\n");
2240                         b43_print_fw_helptext(dev->wl, 0);
2241                 }
2242         }
2243
2244         if (b43_is_old_txhdr_format(dev)) {
2245                 /* We're over the deadline, but we keep support for old fw
2246                  * until it turns out to be in major conflict with something new. */
2247                 b43warn(dev->wl, "You are using an old firmware image. "
2248                         "Support for old firmware will be removed soon "
2249                         "(official deadline was July 2008).\n");
2250                 b43_print_fw_helptext(dev->wl, 0);
2251         }
2252
2253         return 0;
2254
2255 error:
2256         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2257         macctl &= ~B43_MACCTL_PSM_RUN;
2258         macctl |= B43_MACCTL_PSM_JMP0;
2259         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2260
2261         return err;
2262 }
2263
2264 static int b43_write_initvals(struct b43_wldev *dev,
2265                               const struct b43_iv *ivals,
2266                               size_t count,
2267                               size_t array_size)
2268 {
2269         const struct b43_iv *iv;
2270         u16 offset;
2271         size_t i;
2272         bool bit32;
2273
2274         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2275         iv = ivals;
2276         for (i = 0; i < count; i++) {
2277                 if (array_size < sizeof(iv->offset_size))
2278                         goto err_format;
2279                 array_size -= sizeof(iv->offset_size);
2280                 offset = be16_to_cpu(iv->offset_size);
2281                 bit32 = !!(offset & B43_IV_32BIT);
2282                 offset &= B43_IV_OFFSET_MASK;
2283                 if (offset >= 0x1000)
2284                         goto err_format;
2285                 if (bit32) {
2286                         u32 value;
2287
2288                         if (array_size < sizeof(iv->data.d32))
2289                                 goto err_format;
2290                         array_size -= sizeof(iv->data.d32);
2291
2292                         value = get_unaligned_be32(&iv->data.d32);
2293                         b43_write32(dev, offset, value);
2294
2295                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2296                                                         sizeof(__be16) +
2297                                                         sizeof(__be32));
2298                 } else {
2299                         u16 value;
2300
2301                         if (array_size < sizeof(iv->data.d16))
2302                                 goto err_format;
2303                         array_size -= sizeof(iv->data.d16);
2304
2305                         value = be16_to_cpu(iv->data.d16);
2306                         b43_write16(dev, offset, value);
2307
2308                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2309                                                         sizeof(__be16) +
2310                                                         sizeof(__be16));
2311                 }
2312         }
2313         if (array_size)
2314                 goto err_format;
2315
2316         return 0;
2317
2318 err_format:
2319         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2320         b43_print_fw_helptext(dev->wl, 1);
2321
2322         return -EPROTO;
2323 }
2324
2325 static int b43_upload_initvals(struct b43_wldev *dev)
2326 {
2327         const size_t hdr_len = sizeof(struct b43_fw_header);
2328         const struct b43_fw_header *hdr;
2329         struct b43_firmware *fw = &dev->fw;
2330         const struct b43_iv *ivals;
2331         size_t count;
2332         int err;
2333
2334         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2335         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2336         count = be32_to_cpu(hdr->size);
2337         err = b43_write_initvals(dev, ivals, count,
2338                                  fw->initvals.data->size - hdr_len);
2339         if (err)
2340                 goto out;
2341         if (fw->initvals_band.data) {
2342                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2343                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2344                 count = be32_to_cpu(hdr->size);
2345                 err = b43_write_initvals(dev, ivals, count,
2346                                          fw->initvals_band.data->size - hdr_len);
2347                 if (err)
2348                         goto out;
2349         }
2350 out:
2351
2352         return err;
2353 }
2354
2355 /* Initialize the GPIOs
2356  * http://bcm-specs.sipsolutions.net/GPIO
2357  */
2358 static int b43_gpio_init(struct b43_wldev *dev)
2359 {
2360         struct ssb_bus *bus = dev->dev->bus;
2361         struct ssb_device *gpiodev, *pcidev = NULL;
2362         u32 mask, set;
2363
2364         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2365                     & ~B43_MACCTL_GPOUTSMSK);
2366
2367         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2368                     | 0x000F);
2369
2370         mask = 0x0000001F;
2371         set = 0x0000000F;
2372         if (dev->dev->bus->chip_id == 0x4301) {
2373                 mask |= 0x0060;
2374                 set |= 0x0060;
2375         }
2376         if (0 /* FIXME: conditional unknown */ ) {
2377                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2378                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2379                             | 0x0100);
2380                 mask |= 0x0180;
2381                 set |= 0x0180;
2382         }
2383         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2384                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2385                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2386                             | 0x0200);
2387                 mask |= 0x0200;
2388                 set |= 0x0200;
2389         }
2390         if (dev->dev->id.revision >= 2)
2391                 mask |= 0x0010; /* FIXME: This is redundant. */
2392
2393 #ifdef CONFIG_SSB_DRIVER_PCICORE
2394         pcidev = bus->pcicore.dev;
2395 #endif
2396         gpiodev = bus->chipco.dev ? : pcidev;
2397         if (!gpiodev)
2398                 return 0;
2399         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2400                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2401                      & mask) | set);
2402
2403         return 0;
2404 }
2405
2406 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2407 static void b43_gpio_cleanup(struct b43_wldev *dev)
2408 {
2409         struct ssb_bus *bus = dev->dev->bus;
2410         struct ssb_device *gpiodev, *pcidev = NULL;
2411
2412 #ifdef CONFIG_SSB_DRIVER_PCICORE
2413         pcidev = bus->pcicore.dev;
2414 #endif
2415         gpiodev = bus->chipco.dev ? : pcidev;
2416         if (!gpiodev)
2417                 return;
2418         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2419 }
2420
2421 /* http://bcm-specs.sipsolutions.net/EnableMac */
2422 void b43_mac_enable(struct b43_wldev *dev)
2423 {
2424         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2425                 u16 fwstate;
2426
2427                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2428                                          B43_SHM_SH_UCODESTAT);
2429                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2430                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2431                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2432                                "should be suspended, but current state is %u\n",
2433                                fwstate);
2434                 }
2435         }
2436
2437         dev->mac_suspended--;
2438         B43_WARN_ON(dev->mac_suspended < 0);
2439         if (dev->mac_suspended == 0) {
2440                 b43_write32(dev, B43_MMIO_MACCTL,
2441                             b43_read32(dev, B43_MMIO_MACCTL)
2442                             | B43_MACCTL_ENABLED);
2443                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2444                             B43_IRQ_MAC_SUSPENDED);
2445                 /* Commit writes */
2446                 b43_read32(dev, B43_MMIO_MACCTL);
2447                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2448                 b43_power_saving_ctl_bits(dev, 0);
2449         }
2450 }
2451
2452 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2453 void b43_mac_suspend(struct b43_wldev *dev)
2454 {
2455         int i;
2456         u32 tmp;
2457
2458         might_sleep();
2459         B43_WARN_ON(dev->mac_suspended < 0);
2460
2461         if (dev->mac_suspended == 0) {
2462                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2463                 b43_write32(dev, B43_MMIO_MACCTL,
2464                             b43_read32(dev, B43_MMIO_MACCTL)
2465                             & ~B43_MACCTL_ENABLED);
2466                 /* force pci to flush the write */
2467                 b43_read32(dev, B43_MMIO_MACCTL);
2468                 for (i = 35; i; i--) {
2469                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2470                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2471                                 goto out;
2472                         udelay(10);
2473                 }
2474                 /* Hm, it seems this will take some time. Use msleep(). */
2475                 for (i = 40; i; i--) {
2476                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2477                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2478                                 goto out;
2479                         msleep(1);
2480                 }
2481                 b43err(dev->wl, "MAC suspend failed\n");
2482         }
2483 out:
2484         dev->mac_suspended++;
2485 }
2486
2487 static void b43_adjust_opmode(struct b43_wldev *dev)
2488 {
2489         struct b43_wl *wl = dev->wl;
2490         u32 ctl;
2491         u16 cfp_pretbtt;
2492
2493         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2494         /* Reset status to STA infrastructure mode. */
2495         ctl &= ~B43_MACCTL_AP;
2496         ctl &= ~B43_MACCTL_KEEP_CTL;
2497         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2498         ctl &= ~B43_MACCTL_KEEP_BAD;
2499         ctl &= ~B43_MACCTL_PROMISC;
2500         ctl &= ~B43_MACCTL_BEACPROMISC;
2501         ctl |= B43_MACCTL_INFRA;
2502
2503         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2504             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2505                 ctl |= B43_MACCTL_AP;
2506         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2507                 ctl &= ~B43_MACCTL_INFRA;
2508
2509         if (wl->filter_flags & FIF_CONTROL)
2510                 ctl |= B43_MACCTL_KEEP_CTL;
2511         if (wl->filter_flags & FIF_FCSFAIL)
2512                 ctl |= B43_MACCTL_KEEP_BAD;
2513         if (wl->filter_flags & FIF_PLCPFAIL)
2514                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2515         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2516                 ctl |= B43_MACCTL_PROMISC;
2517         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2518                 ctl |= B43_MACCTL_BEACPROMISC;
2519
2520         /* Workaround: On old hardware the HW-MAC-address-filter
2521          * doesn't work properly, so always run promisc in filter
2522          * it in software. */
2523         if (dev->dev->id.revision <= 4)
2524                 ctl |= B43_MACCTL_PROMISC;
2525
2526         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2527
2528         cfp_pretbtt = 2;
2529         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2530                 if (dev->dev->bus->chip_id == 0x4306 &&
2531                     dev->dev->bus->chip_rev == 3)
2532                         cfp_pretbtt = 100;
2533                 else
2534                         cfp_pretbtt = 50;
2535         }
2536         b43_write16(dev, 0x612, cfp_pretbtt);
2537 }
2538
2539 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2540 {
2541         u16 offset;
2542
2543         if (is_ofdm) {
2544                 offset = 0x480;
2545                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2546         } else {
2547                 offset = 0x4C0;
2548                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2549         }
2550         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2551                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2552 }
2553
2554 static void b43_rate_memory_init(struct b43_wldev *dev)
2555 {
2556         switch (dev->phy.type) {
2557         case B43_PHYTYPE_A:
2558         case B43_PHYTYPE_G:
2559         case B43_PHYTYPE_N:
2560                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2561                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2562                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2563                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2564                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2565                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2566                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2567                 if (dev->phy.type == B43_PHYTYPE_A)
2568                         break;
2569                 /* fallthrough */
2570         case B43_PHYTYPE_B:
2571                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2572                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2573                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2574                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2575                 break;
2576         default:
2577                 B43_WARN_ON(1);
2578         }
2579 }
2580
2581 /* Set the default values for the PHY TX Control Words. */
2582 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2583 {
2584         u16 ctl = 0;
2585
2586         ctl |= B43_TXH_PHY_ENC_CCK;
2587         ctl |= B43_TXH_PHY_ANT01AUTO;
2588         ctl |= B43_TXH_PHY_TXPWR;
2589
2590         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2591         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2592         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2593 }
2594
2595 /* Set the TX-Antenna for management frames sent by firmware. */
2596 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2597 {
2598         u16 ant;
2599         u16 tmp;
2600
2601         ant = b43_antenna_to_phyctl(antenna);
2602
2603         /* For ACK/CTS */
2604         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2605         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2606         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2607         /* For Probe Resposes */
2608         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2609         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2610         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2611 }
2612
2613 /* This is the opposite of b43_chip_init() */
2614 static void b43_chip_exit(struct b43_wldev *dev)
2615 {
2616         b43_phy_exit(dev);
2617         b43_gpio_cleanup(dev);
2618         /* firmware is released later */
2619 }
2620
2621 /* Initialize the chip
2622  * http://bcm-specs.sipsolutions.net/ChipInit
2623  */
2624 static int b43_chip_init(struct b43_wldev *dev)
2625 {
2626         struct b43_phy *phy = &dev->phy;
2627         int err;
2628         u32 value32, macctl;
2629         u16 value16;
2630
2631         /* Initialize the MAC control */
2632         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2633         if (dev->phy.gmode)
2634                 macctl |= B43_MACCTL_GMODE;
2635         macctl |= B43_MACCTL_INFRA;
2636         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2637
2638         err = b43_request_firmware(dev);
2639         if (err)
2640                 goto out;
2641         err = b43_upload_microcode(dev);
2642         if (err)
2643                 goto out;       /* firmware is released later */
2644
2645         err = b43_gpio_init(dev);
2646         if (err)
2647                 goto out;       /* firmware is released later */
2648
2649         err = b43_upload_initvals(dev);
2650         if (err)
2651                 goto err_gpio_clean;
2652
2653         /* Turn the Analog on and initialize the PHY. */
2654         phy->ops->switch_analog(dev, 1);
2655         err = b43_phy_init(dev);
2656         if (err)
2657                 goto err_gpio_clean;
2658
2659         /* Disable Interference Mitigation. */
2660         if (phy->ops->interf_mitigation)
2661                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2662
2663         /* Select the antennae */
2664         if (phy->ops->set_rx_antenna)
2665                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2666         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2667
2668         if (phy->type == B43_PHYTYPE_B) {
2669                 value16 = b43_read16(dev, 0x005E);
2670                 value16 |= 0x0004;
2671                 b43_write16(dev, 0x005E, value16);
2672         }
2673         b43_write32(dev, 0x0100, 0x01000000);
2674         if (dev->dev->id.revision < 5)
2675                 b43_write32(dev, 0x010C, 0x01000000);
2676
2677         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2678                     & ~B43_MACCTL_INFRA);
2679         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2680                     | B43_MACCTL_INFRA);
2681
2682         /* Probe Response Timeout value */
2683         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2684         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2685
2686         /* Initially set the wireless operation mode. */
2687         b43_adjust_opmode(dev);
2688
2689         if (dev->dev->id.revision < 3) {
2690                 b43_write16(dev, 0x060E, 0x0000);
2691                 b43_write16(dev, 0x0610, 0x8000);
2692                 b43_write16(dev, 0x0604, 0x0000);
2693                 b43_write16(dev, 0x0606, 0x0200);
2694         } else {
2695                 b43_write32(dev, 0x0188, 0x80000000);
2696                 b43_write32(dev, 0x018C, 0x02000000);
2697         }
2698         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2699         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2700         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2701         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2702         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2703         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2704         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2705
2706         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2707         value32 |= 0x00100000;
2708         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2709
2710         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2711                     dev->dev->bus->chipco.fast_pwrup_delay);
2712
2713         err = 0;
2714         b43dbg(dev->wl, "Chip initialized\n");
2715 out:
2716         return err;
2717
2718 err_gpio_clean:
2719         b43_gpio_cleanup(dev);
2720         return err;
2721 }
2722
2723 static void b43_periodic_every60sec(struct b43_wldev *dev)
2724 {
2725         const struct b43_phy_operations *ops = dev->phy.ops;
2726
2727         if (ops->pwork_60sec)
2728                 ops->pwork_60sec(dev);
2729
2730         /* Force check the TX power emission now. */
2731         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2732 }
2733
2734 static void b43_periodic_every30sec(struct b43_wldev *dev)
2735 {
2736         /* Update device statistics. */
2737         b43_calculate_link_quality(dev);
2738 }
2739
2740 static void b43_periodic_every15sec(struct b43_wldev *dev)
2741 {
2742         struct b43_phy *phy = &dev->phy;
2743         u16 wdr;
2744
2745         if (dev->fw.opensource) {
2746                 /* Check if the firmware is still alive.
2747                  * It will reset the watchdog counter to 0 in its idle loop. */
2748                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2749                 if (unlikely(wdr)) {
2750                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2751                         b43_controller_restart(dev, "Firmware watchdog");
2752                         return;
2753                 } else {
2754                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2755                                         B43_WATCHDOG_REG, 1);
2756                 }
2757         }
2758
2759         if (phy->ops->pwork_15sec)
2760                 phy->ops->pwork_15sec(dev);
2761
2762         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2763         wmb();
2764 }
2765
2766 static void do_periodic_work(struct b43_wldev *dev)
2767 {
2768         unsigned int state;
2769
2770         state = dev->periodic_state;
2771         if (state % 4 == 0)
2772                 b43_periodic_every60sec(dev);
2773         if (state % 2 == 0)
2774                 b43_periodic_every30sec(dev);
2775         b43_periodic_every15sec(dev);
2776 }
2777
2778 /* Periodic work locking policy:
2779  *      The whole periodic work handler is protected by
2780  *      wl->mutex. If another lock is needed somewhere in the
2781  *      pwork callchain, it's aquired in-place, where it's needed.
2782  */
2783 static void b43_periodic_work_handler(struct work_struct *work)
2784 {
2785         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2786                                              periodic_work.work);
2787         struct b43_wl *wl = dev->wl;
2788         unsigned long delay;
2789
2790         mutex_lock(&wl->mutex);
2791
2792         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2793                 goto out;
2794         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2795                 goto out_requeue;
2796
2797         do_periodic_work(dev);
2798
2799         dev->periodic_state++;
2800 out_requeue:
2801         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2802                 delay = msecs_to_jiffies(50);
2803         else
2804                 delay = round_jiffies_relative(HZ * 15);
2805         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2806 out:
2807         mutex_unlock(&wl->mutex);
2808 }
2809
2810 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2811 {
2812         struct delayed_work *work = &dev->periodic_work;
2813
2814         dev->periodic_state = 0;
2815         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2816         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2817 }
2818
2819 /* Check if communication with the device works correctly. */
2820 static int b43_validate_chipaccess(struct b43_wldev *dev)
2821 {
2822         u32 v, backup0, backup4;
2823
2824         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2825         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2826
2827         /* Check for read/write and endianness problems. */
2828         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2829         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2830                 goto error;
2831         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2832         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2833                 goto error;
2834
2835         /* Check if unaligned 32bit SHM_SHARED access works properly.
2836          * However, don't bail out on failure, because it's noncritical. */
2837         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2838         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2839         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2840         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2841         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2842                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2843         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2844         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2845             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2846             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2847             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2848                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2849
2850         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2851         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2852
2853         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2854                 /* The 32bit register shadows the two 16bit registers
2855                  * with update sideeffects. Validate this. */
2856                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2857                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2858                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2859                         goto error;
2860                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2861                         goto error;
2862         }
2863         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2864
2865         v = b43_read32(dev, B43_MMIO_MACCTL);
2866         v |= B43_MACCTL_GMODE;
2867         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2868                 goto error;
2869
2870         return 0;
2871 error:
2872         b43err(dev->wl, "Failed to validate the chipaccess\n");
2873         return -ENODEV;
2874 }
2875
2876 static void b43_security_init(struct b43_wldev *dev)
2877 {
2878         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2879         /* KTP is a word address, but we address SHM bytewise.
2880          * So multiply by two.
2881          */
2882         dev->ktp *= 2;
2883         /* Number of RCMTA address slots */
2884         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
2885         /* Clear the key memory. */
2886         b43_clear_keys(dev);
2887 }
2888
2889 #ifdef CONFIG_B43_HWRNG
2890 static int b43_rng_read(struct hwrng *rng, u32 *data)
2891 {
2892         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2893         unsigned long flags;
2894
2895         /* Don't take wl->mutex here, as it could deadlock with
2896          * hwrng internal locking. It's not needed to take
2897          * wl->mutex here, anyway. */
2898
2899         spin_lock_irqsave(&wl->irq_lock, flags);
2900         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2901         spin_unlock_irqrestore(&wl->irq_lock, flags);
2902
2903         return (sizeof(u16));
2904 }
2905 #endif /* CONFIG_B43_HWRNG */
2906
2907 static void b43_rng_exit(struct b43_wl *wl)
2908 {
2909 #ifdef CONFIG_B43_HWRNG
2910         if (wl->rng_initialized)
2911                 hwrng_unregister(&wl->rng);
2912 #endif /* CONFIG_B43_HWRNG */
2913 }
2914
2915 static int b43_rng_init(struct b43_wl *wl)
2916 {
2917         int err = 0;
2918
2919 #ifdef CONFIG_B43_HWRNG
2920         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2921                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2922         wl->rng.name = wl->rng_name;
2923         wl->rng.data_read = b43_rng_read;
2924         wl->rng.priv = (unsigned long)wl;
2925         wl->rng_initialized = 1;
2926         err = hwrng_register(&wl->rng);
2927         if (err) {
2928                 wl->rng_initialized = 0;
2929                 b43err(wl, "Failed to register the random "
2930                        "number generator (%d)\n", err);
2931         }
2932 #endif /* CONFIG_B43_HWRNG */
2933
2934         return err;
2935 }
2936
2937 static int b43_op_tx(struct ieee80211_hw *hw,
2938                      struct sk_buff *skb)
2939 {
2940         struct b43_wl *wl = hw_to_b43_wl(hw);
2941         struct b43_wldev *dev = wl->current_dev;
2942         unsigned long flags;
2943         int err;
2944
2945         if (unlikely(skb->len < 2 + 2 + 6)) {
2946                 /* Too short, this can't be a valid frame. */
2947                 goto drop_packet;
2948         }
2949         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2950         if (unlikely(!dev))
2951                 goto drop_packet;
2952
2953         /* Transmissions on seperate queues can run concurrently. */
2954         read_lock_irqsave(&wl->tx_lock, flags);
2955
2956         err = -ENODEV;
2957         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2958                 if (b43_using_pio_transfers(dev))
2959                         err = b43_pio_tx(dev, skb);
2960                 else
2961                         err = b43_dma_tx(dev, skb);
2962         }
2963
2964         read_unlock_irqrestore(&wl->tx_lock, flags);
2965
2966         if (unlikely(err))
2967                 goto drop_packet;
2968         return NETDEV_TX_OK;
2969
2970 drop_packet:
2971         /* We can not transmit this packet. Drop it. */
2972         dev_kfree_skb_any(skb);
2973         return NETDEV_TX_OK;
2974 }
2975
2976 /* Locking: wl->irq_lock */
2977 static void b43_qos_params_upload(struct b43_wldev *dev,
2978                                   const struct ieee80211_tx_queue_params *p,
2979                                   u16 shm_offset)
2980 {
2981         u16 params[B43_NR_QOSPARAMS];
2982         int bslots, tmp;
2983         unsigned int i;
2984
2985         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2986
2987         memset(&params, 0, sizeof(params));
2988
2989         params[B43_QOSPARAM_TXOP] = p->txop * 32;
2990         params[B43_QOSPARAM_CWMIN] = p->cw_min;
2991         params[B43_QOSPARAM_CWMAX] = p->cw_max;
2992         params[B43_QOSPARAM_CWCUR] = p->cw_min;
2993         params[B43_QOSPARAM_AIFS] = p->aifs;
2994         params[B43_QOSPARAM_BSLOTS] = bslots;
2995         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
2996
2997         for (i = 0; i < ARRAY_SIZE(params); i++) {
2998                 if (i == B43_QOSPARAM_STATUS) {
2999                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3000                                              shm_offset + (i * 2));
3001                         /* Mark the parameters as updated. */
3002                         tmp |= 0x100;
3003                         b43_shm_write16(dev, B43_SHM_SHARED,
3004                                         shm_offset + (i * 2),
3005                                         tmp);
3006                 } else {
3007                         b43_shm_write16(dev, B43_SHM_SHARED,
3008                                         shm_offset + (i * 2),
3009                                         params[i]);
3010                 }
3011         }
3012 }
3013
3014 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3015 static const u16 b43_qos_shm_offsets[] = {
3016         /* [mac80211-queue-nr] = SHM_OFFSET, */
3017         [0] = B43_QOS_VOICE,
3018         [1] = B43_QOS_VIDEO,
3019         [2] = B43_QOS_BESTEFFORT,
3020         [3] = B43_QOS_BACKGROUND,
3021 };
3022
3023 /* Update all QOS parameters in hardware. */
3024 static void b43_qos_upload_all(struct b43_wldev *dev)
3025 {
3026         struct b43_wl *wl = dev->wl;
3027         struct b43_qos_params *params;
3028         unsigned int i;
3029
3030         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3031                      ARRAY_SIZE(wl->qos_params));
3032
3033         b43_mac_suspend(dev);
3034         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3035                 params = &(wl->qos_params[i]);
3036                 b43_qos_params_upload(dev, &(params->p),
3037                                       b43_qos_shm_offsets[i]);
3038         }
3039         b43_mac_enable(dev);
3040 }
3041
3042 static void b43_qos_clear(struct b43_wl *wl)
3043 {
3044         struct b43_qos_params *params;
3045         unsigned int i;
3046
3047         /* Initialize QoS parameters to sane defaults. */
3048
3049         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3050                      ARRAY_SIZE(wl->qos_params));
3051
3052         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3053                 params = &(wl->qos_params[i]);
3054
3055                 switch (b43_qos_shm_offsets[i]) {
3056                 case B43_QOS_VOICE:
3057                         params->p.txop = 0;
3058                         params->p.aifs = 2;
3059                         params->p.cw_min = 0x0001;
3060                         params->p.cw_max = 0x0001;
3061                         break;
3062                 case B43_QOS_VIDEO:
3063                         params->p.txop = 0;
3064                         params->p.aifs = 2;
3065                         params->p.cw_min = 0x0001;
3066                         params->p.cw_max = 0x0001;
3067                         break;
3068                 case B43_QOS_BESTEFFORT:
3069                         params->p.txop = 0;
3070                         params->p.aifs = 3;
3071                         params->p.cw_min = 0x0001;
3072                         params->p.cw_max = 0x03FF;
3073                         break;
3074                 case B43_QOS_BACKGROUND:
3075                         params->p.txop = 0;
3076                         params->p.aifs = 7;
3077                         params->p.cw_min = 0x0001;
3078                         params->p.cw_max = 0x03FF;
3079                         break;
3080                 default:
3081                         B43_WARN_ON(1);
3082                 }
3083         }
3084 }
3085
3086 /* Initialize the core's QOS capabilities */
3087 static void b43_qos_init(struct b43_wldev *dev)
3088 {
3089         /* Upload the current QOS parameters. */
3090         b43_qos_upload_all(dev);
3091
3092         /* Enable QOS support. */
3093         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3094         b43_write16(dev, B43_MMIO_IFSCTL,
3095                     b43_read16(dev, B43_MMIO_IFSCTL)
3096                     | B43_MMIO_IFSCTL_USE_EDCF);
3097 }
3098
3099 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3100                           const struct ieee80211_tx_queue_params *params)
3101 {
3102         struct b43_wl *wl = hw_to_b43_wl(hw);
3103         struct b43_wldev *dev;
3104         unsigned int queue = (unsigned int)_queue;
3105         int err = -ENODEV;
3106
3107         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3108                 /* Queue not available or don't support setting
3109                  * params on this queue. Return success to not
3110                  * confuse mac80211. */
3111                 return 0;
3112         }
3113         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3114                      ARRAY_SIZE(wl->qos_params));
3115
3116         mutex_lock(&wl->mutex);
3117         dev = wl->current_dev;
3118         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3119                 goto out_unlock;
3120
3121         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3122         b43_mac_suspend(dev);
3123         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3124                               b43_qos_shm_offsets[queue]);
3125         b43_mac_enable(dev);
3126         err = 0;
3127
3128 out_unlock:
3129         mutex_unlock(&wl->mutex);
3130
3131         return err;
3132 }
3133
3134 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3135                                struct ieee80211_tx_queue_stats *stats)
3136 {
3137         struct b43_wl *wl = hw_to_b43_wl(hw);
3138         struct b43_wldev *dev = wl->current_dev;
3139         unsigned long flags;
3140         int err = -ENODEV;
3141
3142         if (!dev)
3143                 goto out;
3144         spin_lock_irqsave(&wl->irq_lock, flags);
3145         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3146                 if (b43_using_pio_transfers(dev))
3147                         b43_pio_get_tx_stats(dev, stats);
3148                 else
3149                         b43_dma_get_tx_stats(dev, stats);
3150                 err = 0;
3151         }
3152         spin_unlock_irqrestore(&wl->irq_lock, flags);
3153 out:
3154         return err;
3155 }
3156
3157 static int b43_op_get_stats(struct ieee80211_hw *hw,
3158                             struct ieee80211_low_level_stats *stats)
3159 {
3160         struct b43_wl *wl = hw_to_b43_wl(hw);
3161         unsigned long flags;
3162
3163         spin_lock_irqsave(&wl->irq_lock, flags);
3164         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3165         spin_unlock_irqrestore(&wl->irq_lock, flags);
3166
3167         return 0;
3168 }
3169
3170 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3171 {
3172         struct b43_wl *wl = hw_to_b43_wl(hw);
3173         struct b43_wldev *dev;
3174         u64 tsf;
3175
3176         mutex_lock(&wl->mutex);
3177         spin_lock_irq(&wl->irq_lock);
3178         dev = wl->current_dev;
3179
3180         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3181                 b43_tsf_read(dev, &tsf);
3182         else
3183                 tsf = 0;
3184
3185         spin_unlock_irq(&wl->irq_lock);
3186         mutex_unlock(&wl->mutex);
3187
3188         return tsf;
3189 }
3190
3191 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3192 {
3193         struct b43_wl *wl = hw_to_b43_wl(hw);
3194         struct b43_wldev *dev;
3195
3196         mutex_lock(&wl->mutex);
3197         spin_lock_irq(&wl->irq_lock);
3198         dev = wl->current_dev;
3199
3200         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3201                 b43_tsf_write(dev, tsf);
3202
3203         spin_unlock_irq(&wl->irq_lock);
3204         mutex_unlock(&wl->mutex);
3205 }
3206
3207 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3208 {
3209         struct ssb_device *sdev = dev->dev;
3210         u32 tmslow;
3211
3212         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3213         tmslow &= ~B43_TMSLOW_GMODE;
3214         tmslow |= B43_TMSLOW_PHYRESET;
3215         tmslow |= SSB_TMSLOW_FGC;
3216         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3217         msleep(1);
3218
3219         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3220         tmslow &= ~SSB_TMSLOW_FGC;
3221         tmslow |= B43_TMSLOW_PHYRESET;
3222         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3223         msleep(1);
3224 }
3225
3226 static const char *band_to_string(enum ieee80211_band band)
3227 {
3228         switch (band) {
3229         case IEEE80211_BAND_5GHZ:
3230                 return "5";
3231         case IEEE80211_BAND_2GHZ:
3232                 return "2.4";
3233         default:
3234                 break;
3235         }
3236         B43_WARN_ON(1);
3237         return "";
3238 }
3239
3240 /* Expects wl->mutex locked */
3241 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3242 {
3243         struct b43_wldev *up_dev = NULL;
3244         struct b43_wldev *down_dev;
3245         struct b43_wldev *d;
3246         int err;
3247         bool uninitialized_var(gmode);
3248         int prev_status;
3249
3250         /* Find a device and PHY which supports the band. */
3251         list_for_each_entry(d, &wl->devlist, list) {
3252                 switch (chan->band) {
3253                 case IEEE80211_BAND_5GHZ:
3254                         if (d->phy.supports_5ghz) {
3255                                 up_dev = d;
3256                                 gmode = 0;
3257                         }
3258                         break;
3259                 case IEEE80211_BAND_2GHZ:
3260                         if (d->phy.supports_2ghz) {
3261                                 up_dev = d;
3262                                 gmode = 1;
3263                         }
3264                         break;
3265                 default:
3266                         B43_WARN_ON(1);
3267                         return -EINVAL;
3268                 }
3269                 if (up_dev)
3270                         break;
3271         }
3272         if (!up_dev) {
3273                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3274                        band_to_string(chan->band));
3275                 return -ENODEV;
3276         }
3277         if ((up_dev == wl->current_dev) &&
3278             (!!wl->current_dev->phy.gmode == !!gmode)) {
3279                 /* This device is already running. */
3280                 return 0;
3281         }
3282         b43dbg(wl, "Switching to %s-GHz band\n",
3283                band_to_string(chan->band));
3284         down_dev = wl->current_dev;
3285
3286         prev_status = b43_status(down_dev);
3287         /* Shutdown the currently running core. */
3288         if (prev_status >= B43_STAT_STARTED)
3289                 b43_wireless_core_stop(down_dev);
3290         if (prev_status >= B43_STAT_INITIALIZED)
3291                 b43_wireless_core_exit(down_dev);
3292
3293         if (down_dev != up_dev) {
3294                 /* We switch to a different core, so we put PHY into
3295                  * RESET on the old core. */
3296                 b43_put_phy_into_reset(down_dev);
3297         }
3298
3299         /* Now start the new core. */
3300         up_dev->phy.gmode = gmode;
3301         if (prev_status >= B43_STAT_INITIALIZED) {
3302                 err = b43_wireless_core_init(up_dev);
3303                 if (err) {
3304                         b43err(wl, "Fatal: Could not initialize device for "
3305                                "selected %s-GHz band\n",
3306                                band_to_string(chan->band));
3307                         goto init_failure;
3308                 }
3309         }
3310         if (prev_status >= B43_STAT_STARTED) {
3311                 err = b43_wireless_core_start(up_dev);
3312                 if (err) {
3313                         b43err(wl, "Fatal: Coult not start device for "
3314                                "selected %s-GHz band\n",
3315                                band_to_string(chan->band));
3316                         b43_wireless_core_exit(up_dev);
3317                         goto init_failure;
3318                 }
3319         }
3320         B43_WARN_ON(b43_status(up_dev) != prev_status);
3321
3322         wl->current_dev = up_dev;
3323
3324         return 0;
3325 init_failure:
3326         /* Whoops, failed to init the new core. No core is operating now. */
3327         wl->current_dev = NULL;
3328         return err;
3329 }
3330
3331 /* Write the short and long frame retry limit values. */
3332 static void b43_set_retry_limits(struct b43_wldev *dev,
3333                                  unsigned int short_retry,
3334                                  unsigned int long_retry)
3335 {
3336         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3337          * the chip-internal counter. */
3338         short_retry = min(short_retry, (unsigned int)0xF);
3339         long_retry = min(long_retry, (unsigned int)0xF);
3340
3341         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3342                         short_retry);
3343         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3344                         long_retry);
3345 }
3346
3347 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3348 {
3349         struct b43_wl *wl = hw_to_b43_wl(hw);
3350         struct b43_wldev *dev;
3351         struct b43_phy *phy;
3352         struct ieee80211_conf *conf = &hw->conf;
3353         unsigned long flags;
3354         int antenna;
3355         int err = 0;
3356
3357         mutex_lock(&wl->mutex);
3358
3359         /* Switch the band (if necessary). This might change the active core. */
3360         err = b43_switch_band(wl, conf->channel);
3361         if (err)
3362                 goto out_unlock_mutex;
3363         dev = wl->current_dev;
3364         phy = &dev->phy;
3365
3366         b43_mac_suspend(dev);
3367
3368         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3369                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3370                                           conf->long_frame_max_tx_count);
3371         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3372         if (!changed)
3373                 goto out_mac_enable;
3374
3375         /* Switch to the requested channel.
3376          * The firmware takes care of races with the TX handler. */
3377         if (conf->channel->hw_value != phy->channel)
3378                 b43_switch_channel(dev, conf->channel->hw_value);
3379
3380         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3381
3382         /* Adjust the desired TX power level. */
3383         if (conf->power_level != 0) {
3384                 spin_lock_irqsave(&wl->irq_lock, flags);
3385                 if (conf->power_level != phy->desired_txpower) {
3386                         phy->desired_txpower = conf->power_level;
3387                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3388                                                    B43_TXPWR_IGNORE_TSSI);
3389                 }
3390                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3391         }
3392
3393         /* Antennas for RX and management frame TX. */
3394         antenna = B43_ANTENNA_DEFAULT;
3395         b43_mgmtframe_txantenna(dev, antenna);
3396         antenna = B43_ANTENNA_DEFAULT;
3397         if (phy->ops->set_rx_antenna)
3398                 phy->ops->set_rx_antenna(dev, antenna);
3399
3400         if (wl->radio_enabled != phy->radio_on) {
3401                 if (wl->radio_enabled) {
3402                         b43_software_rfkill(dev, false);
3403                         b43info(dev->wl, "Radio turned on by software\n");
3404                         if (!dev->radio_hw_enable) {
3405                                 b43info(dev->wl, "The hardware RF-kill button "
3406                                         "still turns the radio physically off. "
3407                                         "Press the button to turn it on.\n");
3408                         }
3409                 } else {
3410                         b43_software_rfkill(dev, true);
3411                         b43info(dev->wl, "Radio turned off by software\n");
3412                 }
3413         }
3414
3415 out_mac_enable:
3416         b43_mac_enable(dev);
3417 out_unlock_mutex:
3418         mutex_unlock(&wl->mutex);
3419
3420         return err;
3421 }
3422
3423 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3424 {
3425         struct ieee80211_supported_band *sband =
3426                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3427         struct ieee80211_rate *rate;
3428         int i;
3429         u16 basic, direct, offset, basic_offset, rateptr;
3430
3431         for (i = 0; i < sband->n_bitrates; i++) {
3432                 rate = &sband->bitrates[i];
3433
3434                 if (b43_is_cck_rate(rate->hw_value)) {
3435                         direct = B43_SHM_SH_CCKDIRECT;
3436                         basic = B43_SHM_SH_CCKBASIC;
3437                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3438                         offset &= 0xF;
3439                 } else {
3440                         direct = B43_SHM_SH_OFDMDIRECT;
3441                         basic = B43_SHM_SH_OFDMBASIC;
3442                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3443                         offset &= 0xF;
3444                 }
3445
3446                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3447
3448                 if (b43_is_cck_rate(rate->hw_value)) {
3449                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3450                         basic_offset &= 0xF;
3451                 } else {
3452                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3453                         basic_offset &= 0xF;
3454                 }
3455
3456                 /*
3457                  * Get the pointer that we need to point to
3458                  * from the direct map
3459                  */
3460                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3461                                          direct + 2 * basic_offset);
3462                 /* and write it to the basic map */
3463                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3464                                 rateptr);
3465         }
3466 }
3467
3468 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3469                                     struct ieee80211_vif *vif,
3470                                     struct ieee80211_bss_conf *conf,
3471                                     u32 changed)
3472 {
3473         struct b43_wl *wl = hw_to_b43_wl(hw);
3474         struct b43_wldev *dev;
3475         unsigned long flags;
3476
3477         mutex_lock(&wl->mutex);
3478
3479         dev = wl->current_dev;
3480         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3481                 goto out_unlock_mutex;
3482
3483         B43_WARN_ON(wl->vif != vif);
3484
3485         spin_lock_irqsave(&wl->irq_lock, flags);
3486         if (changed & BSS_CHANGED_BSSID) {
3487                 if (conf->bssid)
3488                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3489                 else
3490                         memset(wl->bssid, 0, ETH_ALEN);
3491         }
3492
3493         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3494                 if (changed & BSS_CHANGED_BEACON &&
3495                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3496                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3497                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3498                         b43_update_templates(wl);
3499
3500                 if (changed & BSS_CHANGED_BSSID)
3501                         b43_write_mac_bssid_templates(dev);
3502         }
3503         spin_unlock_irqrestore(&wl->irq_lock, flags);
3504
3505         b43_mac_suspend(dev);
3506
3507         /* Update templates for AP/mesh mode. */
3508         if (changed & BSS_CHANGED_BEACON_INT &&
3509             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3510              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3511              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3512                 b43_set_beacon_int(dev, conf->beacon_int);
3513
3514         if (changed & BSS_CHANGED_BASIC_RATES)
3515                 b43_update_basic_rates(dev, conf->basic_rates);
3516
3517         if (changed & BSS_CHANGED_ERP_SLOT) {
3518                 if (conf->use_short_slot)
3519                         b43_short_slot_timing_enable(dev);
3520                 else
3521                         b43_short_slot_timing_disable(dev);
3522         }
3523
3524         b43_mac_enable(dev);
3525 out_unlock_mutex:
3526         mutex_unlock(&wl->mutex);
3527 }
3528
3529 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3530                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3531                           struct ieee80211_key_conf *key)
3532 {
3533         struct b43_wl *wl = hw_to_b43_wl(hw);
3534         struct b43_wldev *dev;
3535         u8 algorithm;
3536         u8 index;
3537         int err;
3538         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3539
3540         if (modparam_nohwcrypt)
3541                 return -ENOSPC; /* User disabled HW-crypto */
3542
3543         mutex_lock(&wl->mutex);
3544         spin_lock_irq(&wl->irq_lock);
3545         write_lock(&wl->tx_lock);
3546         /* Why do we need all this locking here?
3547          * mutex     -> Every config operation must take it.
3548          * irq_lock  -> We modify the dev->key array, which is accessed
3549          *              in the IRQ handlers.
3550          * tx_lock   -> We modify the dev->key array, which is accessed
3551          *              in the TX handler.
3552          */
3553
3554         dev = wl->current_dev;
3555         err = -ENODEV;
3556         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3557                 goto out_unlock;
3558
3559         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3560                 /* We don't have firmware for the crypto engine.
3561                  * Must use software-crypto. */
3562                 err = -EOPNOTSUPP;
3563                 goto out_unlock;
3564         }
3565
3566         err = -EINVAL;
3567         switch (key->alg) {
3568         case ALG_WEP:
3569                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3570                         algorithm = B43_SEC_ALGO_WEP40;
3571                 else
3572                         algorithm = B43_SEC_ALGO_WEP104;
3573                 break;
3574         case ALG_TKIP:
3575                 algorithm = B43_SEC_ALGO_TKIP;
3576                 break;
3577         case ALG_CCMP:
3578                 algorithm = B43_SEC_ALGO_AES;
3579                 break;
3580         default:
3581                 B43_WARN_ON(1);
3582                 goto out_unlock;
3583         }
3584         index = (u8) (key->keyidx);
3585         if (index > 3)
3586                 goto out_unlock;
3587
3588         switch (cmd) {
3589         case SET_KEY:
3590                 if (algorithm == B43_SEC_ALGO_TKIP) {
3591                         /* FIXME: No TKIP hardware encryption for now. */
3592                         err = -EOPNOTSUPP;
3593                         goto out_unlock;
3594                 }
3595
3596                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3597                         if (WARN_ON(!sta)) {
3598                                 err = -EOPNOTSUPP;
3599                                 goto out_unlock;
3600                         }
3601                         /* Pairwise key with an assigned MAC address. */
3602                         err = b43_key_write(dev, -1, algorithm,
3603                                             key->key, key->keylen,
3604                                             sta->addr, key);
3605                 } else {
3606                         /* Group key */
3607                         err = b43_key_write(dev, index, algorithm,
3608                                             key->key, key->keylen, NULL, key);
3609                 }
3610                 if (err)
3611                         goto out_unlock;
3612
3613                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3614                     algorithm == B43_SEC_ALGO_WEP104) {
3615                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3616                 } else {
3617                         b43_hf_write(dev,
3618                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3619                 }
3620                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3621                 break;
3622         case DISABLE_KEY: {
3623                 err = b43_key_clear(dev, key->hw_key_idx);
3624                 if (err)
3625                         goto out_unlock;
3626                 break;
3627         }
3628         default:
3629                 B43_WARN_ON(1);
3630         }
3631
3632 out_unlock:
3633         if (!err) {
3634                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3635                        "mac: %pM\n",
3636                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3637                        sta ? sta->addr : bcast_addr);
3638                 b43_dump_keymemory(dev);
3639         }
3640         write_unlock(&wl->tx_lock);
3641         spin_unlock_irq(&wl->irq_lock);
3642         mutex_unlock(&wl->mutex);
3643
3644         return err;
3645 }
3646
3647 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3648                                     unsigned int changed, unsigned int *fflags,
3649                                     int mc_count, struct dev_addr_list *mc_list)
3650 {
3651         struct b43_wl *wl = hw_to_b43_wl(hw);
3652         struct b43_wldev *dev = wl->current_dev;
3653         unsigned long flags;
3654
3655         if (!dev) {
3656                 *fflags = 0;
3657                 return;
3658         }
3659
3660         spin_lock_irqsave(&wl->irq_lock, flags);
3661         *fflags &= FIF_PROMISC_IN_BSS |
3662                   FIF_ALLMULTI |
3663                   FIF_FCSFAIL |
3664                   FIF_PLCPFAIL |
3665                   FIF_CONTROL |
3666                   FIF_OTHER_BSS |
3667                   FIF_BCN_PRBRESP_PROMISC;
3668
3669         changed &= FIF_PROMISC_IN_BSS |
3670                    FIF_ALLMULTI |
3671                    FIF_FCSFAIL |
3672                    FIF_PLCPFAIL |
3673                    FIF_CONTROL |
3674                    FIF_OTHER_BSS |
3675                    FIF_BCN_PRBRESP_PROMISC;
3676
3677         wl->filter_flags = *fflags;
3678
3679         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3680                 b43_adjust_opmode(dev);
3681         spin_unlock_irqrestore(&wl->irq_lock, flags);
3682 }
3683
3684 /* Locking: wl->mutex */
3685 static void b43_wireless_core_stop(struct b43_wldev *dev)
3686 {
3687         struct b43_wl *wl = dev->wl;
3688         unsigned long flags;
3689
3690         if (b43_status(dev) < B43_STAT_STARTED)
3691                 return;
3692
3693         /* Disable and sync interrupts. We must do this before than
3694          * setting the status to INITIALIZED, as the interrupt handler
3695          * won't care about IRQs then. */
3696         spin_lock_irqsave(&wl->irq_lock, flags);
3697         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3698         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3699         spin_unlock_irqrestore(&wl->irq_lock, flags);
3700         b43_synchronize_irq(dev);
3701
3702         write_lock_irqsave(&wl->tx_lock, flags);
3703         b43_set_status(dev, B43_STAT_INITIALIZED);
3704         write_unlock_irqrestore(&wl->tx_lock, flags);
3705
3706         b43_pio_stop(dev);
3707         mutex_unlock(&wl->mutex);
3708         /* Must unlock as it would otherwise deadlock. No races here.
3709          * Cancel the possibly running self-rearming periodic work. */
3710         cancel_delayed_work_sync(&dev->periodic_work);
3711         mutex_lock(&wl->mutex);
3712
3713         b43_mac_suspend(dev);
3714         free_irq(dev->dev->irq, dev);
3715         b43dbg(wl, "Wireless interface stopped\n");
3716 }
3717
3718 /* Locking: wl->mutex */
3719 static int b43_wireless_core_start(struct b43_wldev *dev)
3720 {
3721         int err;
3722
3723         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3724
3725         drain_txstatus_queue(dev);
3726         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3727                           IRQF_SHARED, KBUILD_MODNAME, dev);
3728         if (err) {
3729                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3730                 goto out;
3731         }
3732
3733         /* We are ready to run. */
3734         b43_set_status(dev, B43_STAT_STARTED);
3735
3736         /* Start data flow (TX/RX). */
3737         b43_mac_enable(dev);
3738         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3739
3740         /* Start maintainance work */
3741         b43_periodic_tasks_setup(dev);
3742
3743         b43dbg(dev->wl, "Wireless interface started\n");
3744       out:
3745         return err;
3746 }
3747
3748 /* Get PHY and RADIO versioning numbers */
3749 static int b43_phy_versioning(struct b43_wldev *dev)
3750 {
3751         struct b43_phy *phy = &dev->phy;
3752         u32 tmp;
3753         u8 analog_type;
3754         u8 phy_type;
3755         u8 phy_rev;
3756         u16 radio_manuf;
3757         u16 radio_ver;
3758         u16 radio_rev;
3759         int unsupported = 0;
3760
3761         /* Get PHY versioning */
3762         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3763         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3764         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3765         phy_rev = (tmp & B43_PHYVER_VERSION);
3766         switch (phy_type) {
3767         case B43_PHYTYPE_A:
3768                 if (phy_rev >= 4)
3769                         unsupported = 1;
3770                 break;
3771         case B43_PHYTYPE_B:
3772                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3773                     && phy_rev != 7)
3774                         unsupported = 1;
3775                 break;
3776         case B43_PHYTYPE_G:
3777                 if (phy_rev > 9)
3778                         unsupported = 1;
3779                 break;
3780 #ifdef CONFIG_B43_NPHY
3781         case B43_PHYTYPE_N:
3782                 if (phy_rev > 4)
3783                         unsupported = 1;
3784                 break;
3785 #endif
3786 #ifdef CONFIG_B43_PHY_LP
3787         case B43_PHYTYPE_LP:
3788                 if (phy_rev > 1)
3789                         unsupported = 1;
3790                 break;
3791 #endif
3792         default:
3793                 unsupported = 1;
3794         };
3795         if (unsupported) {
3796                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3797                        "(Analog %u, Type %u, Revision %u)\n",
3798                        analog_type, phy_type, phy_rev);
3799                 return -EOPNOTSUPP;
3800         }
3801         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3802                analog_type, phy_type, phy_rev);
3803
3804         /* Get RADIO versioning */
3805         if (dev->dev->bus->chip_id == 0x4317) {
3806                 if (dev->dev->bus->chip_rev == 0)
3807                         tmp = 0x3205017F;
3808                 else if (dev->dev->bus->chip_rev == 1)
3809                         tmp = 0x4205017F;
3810                 else
3811                         tmp = 0x5205017F;
3812         } else {
3813                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3814                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3815                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3816                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3817         }
3818         radio_manuf = (tmp & 0x00000FFF);
3819         radio_ver = (tmp & 0x0FFFF000) >> 12;
3820         radio_rev = (tmp & 0xF0000000) >> 28;
3821         if (radio_manuf != 0x17F /* Broadcom */)
3822                 unsupported = 1;
3823         switch (phy_type) {
3824         case B43_PHYTYPE_A:
3825                 if (radio_ver != 0x2060)
3826                         unsupported = 1;
3827                 if (radio_rev != 1)
3828                         unsupported = 1;
3829                 if (radio_manuf != 0x17F)
3830                         unsupported = 1;
3831                 break;
3832         case B43_PHYTYPE_B:
3833                 if ((radio_ver & 0xFFF0) != 0x2050)
3834                         unsupported = 1;
3835                 break;
3836         case B43_PHYTYPE_G:
3837                 if (radio_ver != 0x2050)
3838                         unsupported = 1;
3839                 break;
3840         case B43_PHYTYPE_N:
3841                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3842                         unsupported = 1;
3843                 break;
3844         case B43_PHYTYPE_LP:
3845                 if (radio_ver != 0x2062)
3846                         unsupported = 1;
3847                 break;
3848         default:
3849                 B43_WARN_ON(1);
3850         }
3851         if (unsupported) {
3852                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3853                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3854                        radio_manuf, radio_ver, radio_rev);
3855                 return -EOPNOTSUPP;
3856         }
3857         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3858                radio_manuf, radio_ver, radio_rev);
3859
3860         phy->radio_manuf = radio_manuf;
3861         phy->radio_ver = radio_ver;
3862         phy->radio_rev = radio_rev;
3863
3864         phy->analog = analog_type;
3865         phy->type = phy_type;
3866         phy->rev = phy_rev;
3867
3868         return 0;
3869 }
3870
3871 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3872                                       struct b43_phy *phy)
3873 {
3874         phy->hardware_power_control = !!modparam_hwpctl;
3875         phy->next_txpwr_check_time = jiffies;
3876         /* PHY TX errors counter. */
3877         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3878
3879 #if B43_DEBUG
3880         phy->phy_locked = 0;
3881         phy->radio_locked = 0;
3882 #endif
3883 }
3884
3885 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3886 {
3887         dev->dfq_valid = 0;
3888
3889         /* Assume the radio is enabled. If it's not enabled, the state will
3890          * immediately get fixed on the first periodic work run. */
3891         dev->radio_hw_enable = 1;
3892
3893         /* Stats */
3894         memset(&dev->stats, 0, sizeof(dev->stats));
3895
3896         setup_struct_phy_for_init(dev, &dev->phy);
3897
3898         /* IRQ related flags */
3899         dev->irq_reason = 0;
3900         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3901         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
3902         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
3903                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
3904
3905         dev->mac_suspended = 1;
3906
3907         /* Noise calculation context */
3908         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3909 }
3910
3911 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3912 {
3913         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3914         u64 hf;
3915
3916         if (!modparam_btcoex)
3917                 return;
3918         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3919                 return;
3920         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3921                 return;
3922
3923         hf = b43_hf_read(dev);
3924         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3925                 hf |= B43_HF_BTCOEXALT;
3926         else
3927                 hf |= B43_HF_BTCOEX;
3928         b43_hf_write(dev, hf);
3929 }
3930
3931 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3932 {
3933         if (!modparam_btcoex)
3934                 return;
3935         //TODO
3936 }
3937
3938 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3939 {
3940 #ifdef CONFIG_SSB_DRIVER_PCICORE
3941         struct ssb_bus *bus = dev->dev->bus;
3942         u32 tmp;
3943
3944         if (bus->pcicore.dev &&
3945             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3946             bus->pcicore.dev->id.revision <= 5) {
3947                 /* IMCFGLO timeouts workaround. */
3948                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3949                 tmp &= ~SSB_IMCFGLO_REQTO;
3950                 tmp &= ~SSB_IMCFGLO_SERTO;
3951                 switch (bus->bustype) {
3952                 case SSB_BUSTYPE_PCI:
3953                 case SSB_BUSTYPE_PCMCIA:
3954                         tmp |= 0x32;
3955                         break;
3956                 case SSB_BUSTYPE_SSB:
3957                         tmp |= 0x53;
3958                         break;
3959                 }
3960                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3961         }
3962 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3963 }
3964
3965 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3966 {
3967         u16 pu_delay;
3968
3969         /* The time value is in microseconds. */
3970         if (dev->phy.type == B43_PHYTYPE_A)
3971                 pu_delay = 3700;
3972         else
3973                 pu_delay = 1050;
3974         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3975                 pu_delay = 500;
3976         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3977                 pu_delay = max(pu_delay, (u16)2400);
3978
3979         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3980 }
3981
3982 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3983 static void b43_set_pretbtt(struct b43_wldev *dev)
3984 {
3985         u16 pretbtt;
3986
3987         /* The time value is in microseconds. */
3988         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3989                 pretbtt = 2;
3990         } else {
3991                 if (dev->phy.type == B43_PHYTYPE_A)
3992                         pretbtt = 120;
3993                 else
3994                         pretbtt = 250;
3995         }
3996         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3997         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3998 }
3999
4000 /* Shutdown a wireless core */
4001 /* Locking: wl->mutex */
4002 static void b43_wireless_core_exit(struct b43_wldev *dev)
4003 {
4004         u32 macctl;
4005
4006         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4007         if (b43_status(dev) != B43_STAT_INITIALIZED)
4008                 return;
4009         b43_set_status(dev, B43_STAT_UNINIT);
4010
4011         /* Stop the microcode PSM. */
4012         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4013         macctl &= ~B43_MACCTL_PSM_RUN;
4014         macctl |= B43_MACCTL_PSM_JMP0;
4015         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4016
4017         if (!dev->suspend_in_progress) {
4018                 b43_leds_exit(dev);
4019                 b43_rng_exit(dev->wl);
4020         }
4021         b43_dma_free(dev);
4022         b43_pio_free(dev);
4023         b43_chip_exit(dev);
4024         dev->phy.ops->switch_analog(dev, 0);
4025         if (dev->wl->current_beacon) {
4026                 dev_kfree_skb_any(dev->wl->current_beacon);
4027                 dev->wl->current_beacon = NULL;
4028         }
4029
4030         ssb_device_disable(dev->dev, 0);
4031         ssb_bus_may_powerdown(dev->dev->bus);
4032 }
4033
4034 /* Initialize a wireless core */
4035 static int b43_wireless_core_init(struct b43_wldev *dev)
4036 {
4037         struct b43_wl *wl = dev->wl;
4038         struct ssb_bus *bus = dev->dev->bus;
4039         struct ssb_sprom *sprom = &bus->sprom;
4040         struct b43_phy *phy = &dev->phy;
4041         int err;
4042         u64 hf;
4043         u32 tmp;
4044
4045         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4046
4047         err = ssb_bus_powerup(bus, 0);
4048         if (err)
4049                 goto out;
4050         if (!ssb_device_is_enabled(dev->dev)) {
4051                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4052                 b43_wireless_core_reset(dev, tmp);
4053         }
4054
4055         /* Reset all data structures. */
4056         setup_struct_wldev_for_init(dev);
4057         phy->ops->prepare_structs(dev);
4058
4059         /* Enable IRQ routing to this device. */
4060         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4061
4062         b43_imcfglo_timeouts_workaround(dev);
4063         b43_bluetooth_coext_disable(dev);
4064         if (phy->ops->prepare_hardware) {
4065                 err = phy->ops->prepare_hardware(dev);
4066                 if (err)
4067                         goto err_busdown;
4068         }
4069         err = b43_chip_init(dev);
4070         if (err)
4071                 goto err_busdown;
4072         b43_shm_write16(dev, B43_SHM_SHARED,
4073                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4074         hf = b43_hf_read(dev);
4075         if (phy->type == B43_PHYTYPE_G) {
4076                 hf |= B43_HF_SYMW;
4077                 if (phy->rev == 1)
4078                         hf |= B43_HF_GDCW;
4079                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4080                         hf |= B43_HF_OFDMPABOOST;
4081         }
4082         if (phy->radio_ver == 0x2050) {
4083                 if (phy->radio_rev == 6)
4084                         hf |= B43_HF_4318TSSI;
4085                 if (phy->radio_rev < 6)
4086                         hf |= B43_HF_VCORECALC;
4087         }
4088         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4089                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4090 #ifdef CONFIG_SSB_DRIVER_PCICORE
4091         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4092             (bus->pcicore.dev->id.revision <= 10))
4093                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4094 #endif
4095         hf &= ~B43_HF_SKCFPUP;
4096         b43_hf_write(dev, hf);
4097
4098         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4099                              B43_DEFAULT_LONG_RETRY_LIMIT);
4100         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4101         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4102
4103         /* Disable sending probe responses from firmware.
4104          * Setting the MaxTime to one usec will always trigger
4105          * a timeout, so we never send any probe resp.
4106          * A timeout of zero is infinite. */
4107         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4108
4109         b43_rate_memory_init(dev);
4110         b43_set_phytxctl_defaults(dev);
4111
4112         /* Minimum Contention Window */
4113         if (phy->type == B43_PHYTYPE_B) {
4114                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4115         } else {
4116                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4117         }
4118         /* Maximum Contention Window */
4119         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4120
4121         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4122                 dev->__using_pio_transfers = 1;
4123                 err = b43_pio_init(dev);
4124         } else {
4125                 dev->__using_pio_transfers = 0;
4126                 err = b43_dma_init(dev);
4127         }
4128         if (err)
4129                 goto err_chip_exit;
4130         b43_qos_init(dev);
4131         b43_set_synth_pu_delay(dev, 1);
4132         b43_bluetooth_coext_enable(dev);
4133
4134         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4135         b43_upload_card_macaddress(dev);
4136         b43_security_init(dev);
4137         if (!dev->suspend_in_progress)
4138                 b43_rng_init(wl);
4139
4140         b43_set_status(dev, B43_STAT_INITIALIZED);
4141
4142         if (!dev->suspend_in_progress)
4143                 b43_leds_init(dev);
4144 out:
4145         return err;
4146
4147 err_chip_exit:
4148         b43_chip_exit(dev);
4149 err_busdown:
4150         ssb_bus_may_powerdown(bus);
4151         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4152         return err;
4153 }
4154
4155 static int b43_op_add_interface(struct ieee80211_hw *hw,
4156                                 struct ieee80211_if_init_conf *conf)
4157 {
4158         struct b43_wl *wl = hw_to_b43_wl(hw);
4159         struct b43_wldev *dev;
4160         unsigned long flags;
4161         int err = -EOPNOTSUPP;
4162
4163         /* TODO: allow WDS/AP devices to coexist */
4164
4165         if (conf->type != NL80211_IFTYPE_AP &&
4166             conf->type != NL80211_IFTYPE_MESH_POINT &&
4167             conf->type != NL80211_IFTYPE_STATION &&
4168             conf->type != NL80211_IFTYPE_WDS &&
4169             conf->type != NL80211_IFTYPE_ADHOC)
4170                 return -EOPNOTSUPP;
4171
4172         mutex_lock(&wl->mutex);
4173         if (wl->operating)
4174                 goto out_mutex_unlock;
4175
4176         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4177
4178         dev = wl->current_dev;
4179         wl->operating = 1;
4180         wl->vif = conf->vif;
4181         wl->if_type = conf->type;
4182         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4183
4184         spin_lock_irqsave(&wl->irq_lock, flags);
4185         b43_adjust_opmode(dev);
4186         b43_set_pretbtt(dev);
4187         b43_set_synth_pu_delay(dev, 0);
4188         b43_upload_card_macaddress(dev);
4189         spin_unlock_irqrestore(&wl->irq_lock, flags);
4190
4191         err = 0;
4192  out_mutex_unlock:
4193         mutex_unlock(&wl->mutex);
4194
4195         return err;
4196 }
4197
4198 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4199                                     struct ieee80211_if_init_conf *conf)
4200 {
4201         struct b43_wl *wl = hw_to_b43_wl(hw);
4202         struct b43_wldev *dev = wl->current_dev;
4203         unsigned long flags;
4204
4205         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4206
4207         mutex_lock(&wl->mutex);
4208
4209         B43_WARN_ON(!wl->operating);
4210         B43_WARN_ON(wl->vif != conf->vif);
4211         wl->vif = NULL;
4212
4213         wl->operating = 0;
4214
4215         spin_lock_irqsave(&wl->irq_lock, flags);
4216         b43_adjust_opmode(dev);
4217         memset(wl->mac_addr, 0, ETH_ALEN);
4218         b43_upload_card_macaddress(dev);
4219         spin_unlock_irqrestore(&wl->irq_lock, flags);
4220
4221         mutex_unlock(&wl->mutex);
4222 }
4223
4224 static int b43_op_start(struct ieee80211_hw *hw)
4225 {
4226         struct b43_wl *wl = hw_to_b43_wl(hw);
4227         struct b43_wldev *dev = wl->current_dev;
4228         int did_init = 0;
4229         int err = 0;
4230
4231         /* Kill all old instance specific information to make sure
4232          * the card won't use it in the short timeframe between start
4233          * and mac80211 reconfiguring it. */
4234         memset(wl->bssid, 0, ETH_ALEN);
4235         memset(wl->mac_addr, 0, ETH_ALEN);
4236         wl->filter_flags = 0;
4237         wl->radiotap_enabled = 0;
4238         b43_qos_clear(wl);
4239         wl->beacon0_uploaded = 0;
4240         wl->beacon1_uploaded = 0;
4241         wl->beacon_templates_virgin = 1;
4242         wl->radio_enabled = 1;
4243
4244         mutex_lock(&wl->mutex);
4245
4246         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4247                 err = b43_wireless_core_init(dev);
4248                 if (err)
4249                         goto out_mutex_unlock;
4250                 did_init = 1;
4251         }
4252
4253         if (b43_status(dev) < B43_STAT_STARTED) {
4254                 err = b43_wireless_core_start(dev);
4255                 if (err) {
4256                         if (did_init)
4257                                 b43_wireless_core_exit(dev);
4258                         goto out_mutex_unlock;
4259                 }
4260         }
4261
4262         /* XXX: only do if device doesn't support rfkill irq */
4263         wiphy_rfkill_start_polling(hw->wiphy);
4264
4265  out_mutex_unlock:
4266         mutex_unlock(&wl->mutex);
4267
4268         return err;
4269 }
4270
4271 static void b43_op_stop(struct ieee80211_hw *hw)
4272 {
4273         struct b43_wl *wl = hw_to_b43_wl(hw);
4274         struct b43_wldev *dev = wl->current_dev;
4275
4276         cancel_work_sync(&(wl->beacon_update_trigger));
4277
4278         mutex_lock(&wl->mutex);
4279         if (b43_status(dev) >= B43_STAT_STARTED)
4280                 b43_wireless_core_stop(dev);
4281         b43_wireless_core_exit(dev);
4282         wl->radio_enabled = 0;
4283         mutex_unlock(&wl->mutex);
4284
4285         cancel_work_sync(&(wl->txpower_adjust_work));
4286 }
4287
4288 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4289                                  struct ieee80211_sta *sta, bool set)
4290 {
4291         struct b43_wl *wl = hw_to_b43_wl(hw);
4292         unsigned long flags;
4293
4294         spin_lock_irqsave(&wl->irq_lock, flags);
4295         b43_update_templates(wl);
4296         spin_unlock_irqrestore(&wl->irq_lock, flags);
4297
4298         return 0;
4299 }
4300
4301 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4302                               struct ieee80211_vif *vif,
4303                               enum sta_notify_cmd notify_cmd,
4304                               struct ieee80211_sta *sta)
4305 {
4306         struct b43_wl *wl = hw_to_b43_wl(hw);
4307
4308         B43_WARN_ON(!vif || wl->vif != vif);
4309 }
4310
4311 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4312 {
4313         struct b43_wl *wl = hw_to_b43_wl(hw);
4314         struct b43_wldev *dev;
4315
4316         mutex_lock(&wl->mutex);
4317         dev = wl->current_dev;
4318         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4319                 /* Disable CFP update during scan on other channels. */
4320                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4321         }
4322         mutex_unlock(&wl->mutex);
4323 }
4324
4325 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4326 {
4327         struct b43_wl *wl = hw_to_b43_wl(hw);
4328         struct b43_wldev *dev;
4329
4330         mutex_lock(&wl->mutex);
4331         dev = wl->current_dev;
4332         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4333                 /* Re-enable CFP update. */
4334                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4335         }
4336         mutex_unlock(&wl->mutex);
4337 }
4338
4339 static const struct ieee80211_ops b43_hw_ops = {
4340         .tx                     = b43_op_tx,
4341         .conf_tx                = b43_op_conf_tx,
4342         .add_interface          = b43_op_add_interface,
4343         .remove_interface       = b43_op_remove_interface,
4344         .config                 = b43_op_config,
4345         .bss_info_changed       = b43_op_bss_info_changed,
4346         .configure_filter       = b43_op_configure_filter,
4347         .set_key                = b43_op_set_key,
4348         .get_stats              = b43_op_get_stats,
4349         .get_tx_stats           = b43_op_get_tx_stats,
4350         .get_tsf                = b43_op_get_tsf,
4351         .set_tsf                = b43_op_set_tsf,
4352         .start                  = b43_op_start,
4353         .stop                   = b43_op_stop,
4354         .set_tim                = b43_op_beacon_set_tim,
4355         .sta_notify             = b43_op_sta_notify,
4356         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4357         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4358         .rfkill_poll            = b43_rfkill_poll,
4359 };
4360
4361 /* Hard-reset the chip. Do not call this directly.
4362  * Use b43_controller_restart()
4363  */
4364 static void b43_chip_reset(struct work_struct *work)
4365 {
4366         struct b43_wldev *dev =
4367             container_of(work, struct b43_wldev, restart_work);
4368         struct b43_wl *wl = dev->wl;
4369         int err = 0;
4370         int prev_status;
4371
4372         mutex_lock(&wl->mutex);
4373
4374         prev_status = b43_status(dev);
4375         /* Bring the device down... */
4376         if (prev_status >= B43_STAT_STARTED)
4377                 b43_wireless_core_stop(dev);
4378         if (prev_status >= B43_STAT_INITIALIZED)
4379                 b43_wireless_core_exit(dev);
4380
4381         /* ...and up again. */
4382         if (prev_status >= B43_STAT_INITIALIZED) {
4383                 err = b43_wireless_core_init(dev);
4384                 if (err)
4385                         goto out;
4386         }
4387         if (prev_status >= B43_STAT_STARTED) {
4388                 err = b43_wireless_core_start(dev);
4389                 if (err) {
4390                         b43_wireless_core_exit(dev);
4391                         goto out;
4392                 }
4393         }
4394 out:
4395         if (err)
4396                 wl->current_dev = NULL; /* Failed to init the dev. */
4397         mutex_unlock(&wl->mutex);
4398         if (err)
4399                 b43err(wl, "Controller restart FAILED\n");
4400         else
4401                 b43info(wl, "Controller restarted\n");
4402 }
4403
4404 static int b43_setup_bands(struct b43_wldev *dev,
4405                            bool have_2ghz_phy, bool have_5ghz_phy)
4406 {
4407         struct ieee80211_hw *hw = dev->wl->hw;
4408
4409         if (have_2ghz_phy)
4410                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4411         if (dev->phy.type == B43_PHYTYPE_N) {
4412                 if (have_5ghz_phy)
4413                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4414         } else {
4415                 if (have_5ghz_phy)
4416                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4417         }
4418
4419         dev->phy.supports_2ghz = have_2ghz_phy;
4420         dev->phy.supports_5ghz = have_5ghz_phy;
4421
4422         return 0;
4423 }
4424
4425 static void b43_wireless_core_detach(struct b43_wldev *dev)
4426 {
4427         /* We release firmware that late to not be required to re-request
4428          * is all the time when we reinit the core. */
4429         b43_release_firmware(dev);
4430         b43_phy_free(dev);
4431 }
4432
4433 static int b43_wireless_core_attach(struct b43_wldev *dev)
4434 {
4435         struct b43_wl *wl = dev->wl;
4436         struct ssb_bus *bus = dev->dev->bus;
4437         struct pci_dev *pdev = bus->host_pci;
4438         int err;
4439         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4440         u32 tmp;
4441
4442         /* Do NOT do any device initialization here.
4443          * Do it in wireless_core_init() instead.
4444          * This function is for gathering basic information about the HW, only.
4445          * Also some structs may be set up here. But most likely you want to have
4446          * that in core_init(), too.
4447          */
4448
4449         err = ssb_bus_powerup(bus, 0);
4450         if (err) {
4451                 b43err(wl, "Bus powerup failed\n");
4452                 goto out;
4453         }
4454         /* Get the PHY type. */
4455         if (dev->dev->id.revision >= 5) {
4456                 u32 tmshigh;
4457
4458                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4459                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4460                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4461         } else
4462                 B43_WARN_ON(1);
4463
4464         dev->phy.gmode = have_2ghz_phy;
4465         dev->phy.radio_on = 1;
4466         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4467         b43_wireless_core_reset(dev, tmp);
4468
4469         err = b43_phy_versioning(dev);
4470         if (err)
4471                 goto err_powerdown;
4472         /* Check if this device supports multiband. */
4473         if (!pdev ||
4474             (pdev->device != 0x4312 &&
4475              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4476                 /* No multiband support. */
4477                 have_2ghz_phy = 0;
4478                 have_5ghz_phy = 0;
4479                 switch (dev->phy.type) {
4480                 case B43_PHYTYPE_A:
4481                         have_5ghz_phy = 1;
4482                         break;
4483                 case B43_PHYTYPE_G:
4484                 case B43_PHYTYPE_N:
4485                 case B43_PHYTYPE_LP:
4486                         have_2ghz_phy = 1;
4487                         break;
4488                 default:
4489                         B43_WARN_ON(1);
4490                 }
4491         }
4492         if (dev->phy.type == B43_PHYTYPE_A) {
4493                 /* FIXME */
4494                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4495                 err = -EOPNOTSUPP;
4496                 goto err_powerdown;
4497         }
4498         if (1 /* disable A-PHY */) {
4499                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4500                 if (dev->phy.type != B43_PHYTYPE_N) {
4501                         have_2ghz_phy = 1;
4502                         have_5ghz_phy = 0;
4503                 }
4504         }
4505
4506         err = b43_phy_allocate(dev);
4507         if (err)
4508                 goto err_powerdown;
4509
4510         dev->phy.gmode = have_2ghz_phy;
4511         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4512         b43_wireless_core_reset(dev, tmp);
4513
4514         err = b43_validate_chipaccess(dev);
4515         if (err)
4516                 goto err_phy_free;
4517         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4518         if (err)
4519                 goto err_phy_free;
4520
4521         /* Now set some default "current_dev" */
4522         if (!wl->current_dev)
4523                 wl->current_dev = dev;
4524         INIT_WORK(&dev->restart_work, b43_chip_reset);
4525
4526         dev->phy.ops->switch_analog(dev, 0);
4527         ssb_device_disable(dev->dev, 0);
4528         ssb_bus_may_powerdown(bus);
4529
4530 out:
4531         return err;
4532
4533 err_phy_free:
4534         b43_phy_free(dev);
4535 err_powerdown:
4536         ssb_bus_may_powerdown(bus);
4537         return err;
4538 }
4539
4540 static void b43_one_core_detach(struct ssb_device *dev)
4541 {
4542         struct b43_wldev *wldev;
4543         struct b43_wl *wl;
4544
4545         /* Do not cancel ieee80211-workqueue based work here.
4546          * See comment in b43_remove(). */
4547
4548         wldev = ssb_get_drvdata(dev);
4549         wl = wldev->wl;
4550         b43_debugfs_remove_device(wldev);
4551         b43_wireless_core_detach(wldev);
4552         list_del(&wldev->list);
4553         wl->nr_devs--;
4554         ssb_set_drvdata(dev, NULL);
4555         kfree(wldev);
4556 }
4557
4558 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4559 {
4560         struct b43_wldev *wldev;
4561         struct pci_dev *pdev;
4562         int err = -ENOMEM;
4563
4564         if (!list_empty(&wl->devlist)) {
4565                 /* We are not the first core on this chip. */
4566                 pdev = dev->bus->host_pci;
4567                 /* Only special chips support more than one wireless
4568                  * core, although some of the other chips have more than
4569                  * one wireless core as well. Check for this and
4570                  * bail out early.
4571                  */
4572                 if (!pdev ||
4573                     ((pdev->device != 0x4321) &&
4574                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4575                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4576                         return -ENODEV;
4577                 }
4578         }
4579
4580         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4581         if (!wldev)
4582                 goto out;
4583
4584         wldev->dev = dev;
4585         wldev->wl = wl;
4586         b43_set_status(wldev, B43_STAT_UNINIT);
4587         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4588         tasklet_init(&wldev->isr_tasklet,
4589                      (void (*)(unsigned long))b43_interrupt_tasklet,
4590                      (unsigned long)wldev);
4591         INIT_LIST_HEAD(&wldev->list);
4592
4593         err = b43_wireless_core_attach(wldev);
4594         if (err)
4595                 goto err_kfree_wldev;
4596
4597         list_add(&wldev->list, &wl->devlist);
4598         wl->nr_devs++;
4599         ssb_set_drvdata(dev, wldev);
4600         b43_debugfs_add_device(wldev);
4601
4602       out:
4603         return err;
4604
4605       err_kfree_wldev:
4606         kfree(wldev);
4607         return err;
4608 }
4609
4610 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4611         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4612         (pdev->device == _device) &&                                    \
4613         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4614         (pdev->subsystem_device == _subdevice)                          )
4615
4616 static void b43_sprom_fixup(struct ssb_bus *bus)
4617 {
4618         struct pci_dev *pdev;
4619
4620         /* boardflags workarounds */
4621         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4622             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4623                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4624         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4625             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4626                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4627         if (bus->bustype == SSB_BUSTYPE_PCI) {
4628                 pdev = bus->host_pci;
4629                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4630                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4631                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4632                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4633                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4634                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4635                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4636                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4637         }
4638 }
4639
4640 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4641 {
4642         struct ieee80211_hw *hw = wl->hw;
4643
4644         ssb_set_devtypedata(dev, NULL);
4645         ieee80211_free_hw(hw);
4646 }
4647
4648 static int b43_wireless_init(struct ssb_device *dev)
4649 {
4650         struct ssb_sprom *sprom = &dev->bus->sprom;
4651         struct ieee80211_hw *hw;
4652         struct b43_wl *wl;
4653         int err = -ENOMEM;
4654
4655         b43_sprom_fixup(dev->bus);
4656
4657         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4658         if (!hw) {
4659                 b43err(NULL, "Could not allocate ieee80211 device\n");
4660                 goto out;
4661         }
4662         wl = hw_to_b43_wl(hw);
4663
4664         /* fill hw info */
4665         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4666                     IEEE80211_HW_SIGNAL_DBM |
4667                     IEEE80211_HW_NOISE_DBM;
4668
4669         hw->wiphy->interface_modes =
4670                 BIT(NL80211_IFTYPE_AP) |
4671                 BIT(NL80211_IFTYPE_MESH_POINT) |
4672                 BIT(NL80211_IFTYPE_STATION) |
4673                 BIT(NL80211_IFTYPE_WDS) |
4674                 BIT(NL80211_IFTYPE_ADHOC);
4675
4676         hw->queues = modparam_qos ? 4 : 1;
4677         wl->mac80211_initially_registered_queues = hw->queues;
4678         hw->max_rates = 2;
4679         SET_IEEE80211_DEV(hw, dev->dev);
4680         if (is_valid_ether_addr(sprom->et1mac))
4681                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4682         else
4683                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4684
4685         /* Initialize struct b43_wl */
4686         wl->hw = hw;
4687         spin_lock_init(&wl->irq_lock);
4688         rwlock_init(&wl->tx_lock);
4689         spin_lock_init(&wl->leds_lock);
4690         spin_lock_init(&wl->shm_lock);
4691         mutex_init(&wl->mutex);
4692         INIT_LIST_HEAD(&wl->devlist);
4693         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4694         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4695
4696         ssb_set_devtypedata(dev, wl);
4697         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4698                 dev->bus->chip_id, dev->id.revision);
4699         err = 0;
4700 out:
4701         return err;
4702 }
4703
4704 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4705 {
4706         struct b43_wl *wl;
4707         int err;
4708         int first = 0;
4709
4710         wl = ssb_get_devtypedata(dev);
4711         if (!wl) {
4712                 /* Probing the first core. Must setup common struct b43_wl */
4713                 first = 1;
4714                 err = b43_wireless_init(dev);
4715                 if (err)
4716                         goto out;
4717                 wl = ssb_get_devtypedata(dev);
4718                 B43_WARN_ON(!wl);
4719         }
4720         err = b43_one_core_attach(dev, wl);
4721         if (err)
4722                 goto err_wireless_exit;
4723
4724         if (first) {
4725                 err = ieee80211_register_hw(wl->hw);
4726                 if (err)
4727                         goto err_one_core_detach;
4728         }
4729
4730       out:
4731         return err;
4732
4733       err_one_core_detach:
4734         b43_one_core_detach(dev);
4735       err_wireless_exit:
4736         if (first)
4737                 b43_wireless_exit(dev, wl);
4738         return err;
4739 }
4740
4741 static void b43_remove(struct ssb_device *dev)
4742 {
4743         struct b43_wl *wl = ssb_get_devtypedata(dev);
4744         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4745
4746         /* We must cancel any work here before unregistering from ieee80211,
4747          * as the ieee80211 unreg will destroy the workqueue. */
4748         cancel_work_sync(&wldev->restart_work);
4749
4750         B43_WARN_ON(!wl);
4751         if (wl->current_dev == wldev) {
4752                 /* Restore the queues count before unregistering, because firmware detect
4753                  * might have modified it. Restoring is important, so the networking
4754                  * stack can properly free resources. */
4755                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4756                 ieee80211_unregister_hw(wl->hw);
4757         }
4758
4759         b43_one_core_detach(dev);
4760
4761         if (list_empty(&wl->devlist)) {
4762                 /* Last core on the chip unregistered.
4763                  * We can destroy common struct b43_wl.
4764                  */
4765                 b43_wireless_exit(dev, wl);
4766         }
4767 }
4768
4769 /* Perform a hardware reset. This can be called from any context. */
4770 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4771 {
4772         /* Must avoid requeueing, if we are in shutdown. */
4773         if (b43_status(dev) < B43_STAT_INITIALIZED)
4774                 return;
4775         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4776         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4777 }
4778
4779 #ifdef CONFIG_PM
4780
4781 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4782 {
4783         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4784         struct b43_wl *wl = wldev->wl;
4785
4786         b43dbg(wl, "Suspending...\n");
4787
4788         mutex_lock(&wl->mutex);
4789         wldev->suspend_in_progress = true;
4790         wldev->suspend_init_status = b43_status(wldev);
4791         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4792                 b43_wireless_core_stop(wldev);
4793         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4794                 b43_wireless_core_exit(wldev);
4795         mutex_unlock(&wl->mutex);
4796
4797         b43dbg(wl, "Device suspended.\n");
4798
4799         return 0;
4800 }
4801
4802 static int b43_resume(struct ssb_device *dev)
4803 {
4804         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4805         struct b43_wl *wl = wldev->wl;
4806         int err = 0;
4807
4808         b43dbg(wl, "Resuming...\n");
4809
4810         mutex_lock(&wl->mutex);
4811         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4812                 err = b43_wireless_core_init(wldev);
4813                 if (err) {
4814                         b43err(wl, "Resume failed at core init\n");
4815                         goto out;
4816                 }
4817         }
4818         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4819                 err = b43_wireless_core_start(wldev);
4820                 if (err) {
4821                         b43_leds_exit(wldev);
4822                         b43_rng_exit(wldev->wl);
4823                         b43_wireless_core_exit(wldev);
4824                         b43err(wl, "Resume failed at core start\n");
4825                         goto out;
4826                 }
4827         }
4828         b43dbg(wl, "Device resumed.\n");
4829  out:
4830         wldev->suspend_in_progress = false;
4831         mutex_unlock(&wl->mutex);
4832         return err;
4833 }
4834
4835 #else /* CONFIG_PM */
4836 # define b43_suspend    NULL
4837 # define b43_resume     NULL
4838 #endif /* CONFIG_PM */
4839
4840 static struct ssb_driver b43_ssb_driver = {
4841         .name           = KBUILD_MODNAME,
4842         .id_table       = b43_ssb_tbl,
4843         .probe          = b43_probe,
4844         .remove         = b43_remove,
4845         .suspend        = b43_suspend,
4846         .resume         = b43_resume,
4847 };
4848
4849 static void b43_print_driverinfo(void)
4850 {
4851         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4852                    *feat_leds = "";
4853
4854 #ifdef CONFIG_B43_PCI_AUTOSELECT
4855         feat_pci = "P";
4856 #endif
4857 #ifdef CONFIG_B43_PCMCIA
4858         feat_pcmcia = "M";
4859 #endif
4860 #ifdef CONFIG_B43_NPHY
4861         feat_nphy = "N";
4862 #endif
4863 #ifdef CONFIG_B43_LEDS
4864         feat_leds = "L";
4865 #endif
4866         printk(KERN_INFO "Broadcom 43xx driver loaded "
4867                "[ Features: %s%s%s%s, Firmware-ID: "
4868                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4869                feat_pci, feat_pcmcia, feat_nphy,
4870                feat_leds);
4871 }
4872
4873 static int __init b43_init(void)
4874 {
4875         int err;
4876
4877         b43_debugfs_init();
4878         err = b43_pcmcia_init();
4879         if (err)
4880                 goto err_dfs_exit;
4881         err = ssb_driver_register(&b43_ssb_driver);
4882         if (err)
4883                 goto err_pcmcia_exit;
4884         b43_print_driverinfo();
4885
4886         return err;
4887
4888 err_pcmcia_exit:
4889         b43_pcmcia_exit();
4890 err_dfs_exit:
4891         b43_debugfs_exit();
4892         return err;
4893 }
4894
4895 static void __exit b43_exit(void)
4896 {
4897         ssb_driver_unregister(&b43_ssb_driver);
4898         b43_pcmcia_exit();
4899         b43_debugfs_exit();
4900 }
4901
4902 module_init(b43_init)
4903 module_exit(b43_exit)