drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1160 {
1161         u32 flags = 0;
1162
1163         if (gmode)
1164                 flags = B43_BCMA_IOCTL_GMODE;
1165         flags |= B43_BCMA_IOCTL_PHY_CLKEN;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         b43_device_enable(dev, flags);
1168
1169         /* TODO: reset PHY */
1170 }
1171 #endif
1172
1173 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1174 {
1175         struct ssb_device *sdev = dev->dev->sdev;
1176         u32 tmslow;
1177         u32 flags = 0;
1178
1179         if (gmode)
1180                 flags |= B43_TMSLOW_GMODE;
1181         flags |= B43_TMSLOW_PHYCLKEN;
1182         flags |= B43_TMSLOW_PHYRESET;
1183         if (dev->phy.type == B43_PHYTYPE_N)
1184                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1185         b43_device_enable(dev, flags);
1186         msleep(2);              /* Wait for the PLL to turn on. */
1187
1188         /* Now take the PHY out of Reset again */
1189         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1190         tmslow |= SSB_TMSLOW_FGC;
1191         tmslow &= ~B43_TMSLOW_PHYRESET;
1192         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1193         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1194         msleep(1);
1195         tmslow &= ~SSB_TMSLOW_FGC;
1196         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1197         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1198         msleep(1);
1199 }
1200
1201 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1202 {
1203         u32 macctl;
1204
1205         switch (dev->dev->bus_type) {
1206 #ifdef CONFIG_B43_BCMA
1207         case B43_BUS_BCMA:
1208                 b43_bcma_wireless_core_reset(dev, gmode);
1209                 break;
1210 #endif
1211 #ifdef CONFIG_B43_SSB
1212         case B43_BUS_SSB:
1213                 b43_ssb_wireless_core_reset(dev, gmode);
1214                 break;
1215 #endif
1216         }
1217
1218         /* Turn Analog ON, but only if we already know the PHY-type.
1219          * This protects against very early setup where we don't know the
1220          * PHY-type, yet. wireless_core_reset will be called once again later,
1221          * when we know the PHY-type. */
1222         if (dev->phy.ops)
1223                 dev->phy.ops->switch_analog(dev, 1);
1224
1225         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1226         macctl &= ~B43_MACCTL_GMODE;
1227         if (gmode)
1228                 macctl |= B43_MACCTL_GMODE;
1229         macctl |= B43_MACCTL_IHR_ENABLED;
1230         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1231 }
1232
1233 static void handle_irq_transmit_status(struct b43_wldev *dev)
1234 {
1235         u32 v0, v1;
1236         u16 tmp;
1237         struct b43_txstatus stat;
1238
1239         while (1) {
1240                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1241                 if (!(v0 & 0x00000001))
1242                         break;
1243                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1244
1245                 stat.cookie = (v0 >> 16);
1246                 stat.seq = (v1 & 0x0000FFFF);
1247                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1248                 tmp = (v0 & 0x0000FFFF);
1249                 stat.frame_count = ((tmp & 0xF000) >> 12);
1250                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1251                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1252                 stat.pm_indicated = !!(tmp & 0x0080);
1253                 stat.intermediate = !!(tmp & 0x0040);
1254                 stat.for_ampdu = !!(tmp & 0x0020);
1255                 stat.acked = !!(tmp & 0x0002);
1256
1257                 b43_handle_txstatus(dev, &stat);
1258         }
1259 }
1260
1261 static void drain_txstatus_queue(struct b43_wldev *dev)
1262 {
1263         u32 dummy;
1264
1265         if (dev->dev->core_rev < 5)
1266                 return;
1267         /* Read all entries from the microcode TXstatus FIFO
1268          * and throw them away.
1269          */
1270         while (1) {
1271                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1272                 if (!(dummy & 0x00000001))
1273                         break;
1274                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1275         }
1276 }
1277
1278 static u32 b43_jssi_read(struct b43_wldev *dev)
1279 {
1280         u32 val = 0;
1281
1282         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1283         val <<= 16;
1284         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1285
1286         return val;
1287 }
1288
1289 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1290 {
1291         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1292         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1293 }
1294
1295 static void b43_generate_noise_sample(struct b43_wldev *dev)
1296 {
1297         b43_jssi_write(dev, 0x7F7F7F7F);
1298         b43_write32(dev, B43_MMIO_MACCMD,
1299                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1300 }
1301
1302 static void b43_calculate_link_quality(struct b43_wldev *dev)
1303 {
1304         /* Top half of Link Quality calculation. */
1305
1306         if (dev->phy.type != B43_PHYTYPE_G)
1307                 return;
1308         if (dev->noisecalc.calculation_running)
1309                 return;
1310         dev->noisecalc.calculation_running = 1;
1311         dev->noisecalc.nr_samples = 0;
1312
1313         b43_generate_noise_sample(dev);
1314 }
1315
1316 static void handle_irq_noise(struct b43_wldev *dev)
1317 {
1318         struct b43_phy_g *phy = dev->phy.g;
1319         u16 tmp;
1320         u8 noise[4];
1321         u8 i, j;
1322         s32 average;
1323
1324         /* Bottom half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328
1329         /* Possible race condition: It might be possible that the user
1330          * changed to a different channel in the meantime since we
1331          * started the calculation. We ignore that fact, since it's
1332          * not really that much of a problem. The background noise is
1333          * an estimation only anyway. Slightly wrong results will get damped
1334          * by the averaging of the 8 sample rounds. Additionally the
1335          * value is shortlived. So it will be replaced by the next noise
1336          * calculation round soon. */
1337
1338         B43_WARN_ON(!dev->noisecalc.calculation_running);
1339         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1340         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1341             noise[2] == 0x7F || noise[3] == 0x7F)
1342                 goto generate_new;
1343
1344         /* Get the noise samples. */
1345         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1346         i = dev->noisecalc.nr_samples;
1347         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1348         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1349         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1350         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1351         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1352         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1353         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1354         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1355         dev->noisecalc.nr_samples++;
1356         if (dev->noisecalc.nr_samples == 8) {
1357                 /* Calculate the Link Quality by the noise samples. */
1358                 average = 0;
1359                 for (i = 0; i < 8; i++) {
1360                         for (j = 0; j < 4; j++)
1361                                 average += dev->noisecalc.samples[i][j];
1362                 }
1363                 average /= (8 * 4);
1364                 average *= 125;
1365                 average += 64;
1366                 average /= 128;
1367                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1368                 tmp = (tmp / 128) & 0x1F;
1369                 if (tmp >= 8)
1370                         average += 2;
1371                 else
1372                         average -= 25;
1373                 if (tmp == 8)
1374                         average -= 72;
1375                 else
1376                         average -= 48;
1377
1378                 dev->stats.link_noise = average;
1379                 dev->noisecalc.calculation_running = 0;
1380                 return;
1381         }
1382 generate_new:
1383         b43_generate_noise_sample(dev);
1384 }
1385
1386 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1387 {
1388         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1389                 ///TODO: PS TBTT
1390         } else {
1391                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1392                         b43_power_saving_ctl_bits(dev, 0);
1393         }
1394         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1395                 dev->dfq_valid = 1;
1396 }
1397
1398 static void handle_irq_atim_end(struct b43_wldev *dev)
1399 {
1400         if (dev->dfq_valid) {
1401                 b43_write32(dev, B43_MMIO_MACCMD,
1402                             b43_read32(dev, B43_MMIO_MACCMD)
1403                             | B43_MACCMD_DFQ_VALID);
1404                 dev->dfq_valid = 0;
1405         }
1406 }
1407
1408 static void handle_irq_pmq(struct b43_wldev *dev)
1409 {
1410         u32 tmp;
1411
1412         //TODO: AP mode.
1413
1414         while (1) {
1415                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1416                 if (!(tmp & 0x00000008))
1417                         break;
1418         }
1419         /* 16bit write is odd, but correct. */
1420         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1421 }
1422
1423 static void b43_write_template_common(struct b43_wldev *dev,
1424                                       const u8 *data, u16 size,
1425                                       u16 ram_offset,
1426                                       u16 shm_size_offset, u8 rate)
1427 {
1428         u32 i, tmp;
1429         struct b43_plcp_hdr4 plcp;
1430
1431         plcp.data = 0;
1432         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1433         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1434         ram_offset += sizeof(u32);
1435         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1436          * So leave the first two bytes of the next write blank.
1437          */
1438         tmp = (u32) (data[0]) << 16;
1439         tmp |= (u32) (data[1]) << 24;
1440         b43_ram_write(dev, ram_offset, tmp);
1441         ram_offset += sizeof(u32);
1442         for (i = 2; i < size; i += sizeof(u32)) {
1443                 tmp = (u32) (data[i + 0]);
1444                 if (i + 1 < size)
1445                         tmp |= (u32) (data[i + 1]) << 8;
1446                 if (i + 2 < size)
1447                         tmp |= (u32) (data[i + 2]) << 16;
1448                 if (i + 3 < size)
1449                         tmp |= (u32) (data[i + 3]) << 24;
1450                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1451         }
1452         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1453                         size + sizeof(struct b43_plcp_hdr6));
1454 }
1455
1456 /* Check if the use of the antenna that ieee80211 told us to
1457  * use is possible. This will fall back to DEFAULT.
1458  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1459 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1460                                   u8 antenna_nr)
1461 {
1462         u8 antenna_mask;
1463
1464         if (antenna_nr == 0) {
1465                 /* Zero means "use default antenna". That's always OK. */
1466                 return 0;
1467         }
1468
1469         /* Get the mask of available antennas. */
1470         if (dev->phy.gmode)
1471                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1472         else
1473                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1474
1475         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1476                 /* This antenna is not available. Fall back to default. */
1477                 return 0;
1478         }
1479
1480         return antenna_nr;
1481 }
1482
1483 /* Convert a b43 antenna number value to the PHY TX control value. */
1484 static u16 b43_antenna_to_phyctl(int antenna)
1485 {
1486         switch (antenna) {
1487         case B43_ANTENNA0:
1488                 return B43_TXH_PHY_ANT0;
1489         case B43_ANTENNA1:
1490                 return B43_TXH_PHY_ANT1;
1491         case B43_ANTENNA2:
1492                 return B43_TXH_PHY_ANT2;
1493         case B43_ANTENNA3:
1494                 return B43_TXH_PHY_ANT3;
1495         case B43_ANTENNA_AUTO0:
1496         case B43_ANTENNA_AUTO1:
1497                 return B43_TXH_PHY_ANT01AUTO;
1498         }
1499         B43_WARN_ON(1);
1500         return 0;
1501 }
1502
1503 static void b43_write_beacon_template(struct b43_wldev *dev,
1504                                       u16 ram_offset,
1505                                       u16 shm_size_offset)
1506 {
1507         unsigned int i, len, variable_len;
1508         const struct ieee80211_mgmt *bcn;
1509         const u8 *ie;
1510         bool tim_found = 0;
1511         unsigned int rate;
1512         u16 ctl;
1513         int antenna;
1514         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1515
1516         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1517         len = min((size_t) dev->wl->current_beacon->len,
1518                   0x200 - sizeof(struct b43_plcp_hdr6));
1519         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1520
1521         b43_write_template_common(dev, (const u8 *)bcn,
1522                                   len, ram_offset, shm_size_offset, rate);
1523
1524         /* Write the PHY TX control parameters. */
1525         antenna = B43_ANTENNA_DEFAULT;
1526         antenna = b43_antenna_to_phyctl(antenna);
1527         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1528         /* We can't send beacons with short preamble. Would get PHY errors. */
1529         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1530         ctl &= ~B43_TXH_PHY_ANT;
1531         ctl &= ~B43_TXH_PHY_ENC;
1532         ctl |= antenna;
1533         if (b43_is_cck_rate(rate))
1534                 ctl |= B43_TXH_PHY_ENC_CCK;
1535         else
1536                 ctl |= B43_TXH_PHY_ENC_OFDM;
1537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1538
1539         /* Find the position of the TIM and the DTIM_period value
1540          * and write them to SHM. */
1541         ie = bcn->u.beacon.variable;
1542         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1543         for (i = 0; i < variable_len - 2; ) {
1544                 uint8_t ie_id, ie_len;
1545
1546                 ie_id = ie[i];
1547                 ie_len = ie[i + 1];
1548                 if (ie_id == 5) {
1549                         u16 tim_position;
1550                         u16 dtim_period;
1551                         /* This is the TIM Information Element */
1552
1553                         /* Check whether the ie_len is in the beacon data range. */
1554                         if (variable_len < ie_len + 2 + i)
1555                                 break;
1556                         /* A valid TIM is at least 4 bytes long. */
1557                         if (ie_len < 4)
1558                                 break;
1559                         tim_found = 1;
1560
1561                         tim_position = sizeof(struct b43_plcp_hdr6);
1562                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563                         tim_position += i;
1564
1565                         dtim_period = ie[i + 3];
1566
1567                         b43_shm_write16(dev, B43_SHM_SHARED,
1568                                         B43_SHM_SH_TIMBPOS, tim_position);
1569                         b43_shm_write16(dev, B43_SHM_SHARED,
1570                                         B43_SHM_SH_DTIMPER, dtim_period);
1571                         break;
1572                 }
1573                 i += ie_len + 2;
1574         }
1575         if (!tim_found) {
1576                 /*
1577                  * If ucode wants to modify TIM do it behind the beacon, this
1578                  * will happen, for example, when doing mesh networking.
1579                  */
1580                 b43_shm_write16(dev, B43_SHM_SHARED,
1581                                 B43_SHM_SH_TIMBPOS,
1582                                 len + sizeof(struct b43_plcp_hdr6));
1583                 b43_shm_write16(dev, B43_SHM_SHARED,
1584                                 B43_SHM_SH_DTIMPER, 0);
1585         }
1586         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1587 }
1588
1589 static void b43_upload_beacon0(struct b43_wldev *dev)
1590 {
1591         struct b43_wl *wl = dev->wl;
1592
1593         if (wl->beacon0_uploaded)
1594                 return;
1595         b43_write_beacon_template(dev, 0x68, 0x18);
1596         wl->beacon0_uploaded = 1;
1597 }
1598
1599 static void b43_upload_beacon1(struct b43_wldev *dev)
1600 {
1601         struct b43_wl *wl = dev->wl;
1602
1603         if (wl->beacon1_uploaded)
1604                 return;
1605         b43_write_beacon_template(dev, 0x468, 0x1A);
1606         wl->beacon1_uploaded = 1;
1607 }
1608
1609 static void handle_irq_beacon(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612         u32 cmd, beacon0_valid, beacon1_valid;
1613
1614         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1615             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1616                 return;
1617
1618         /* This is the bottom half of the asynchronous beacon update. */
1619
1620         /* Ignore interrupt in the future. */
1621         dev->irq_mask &= ~B43_IRQ_BEACON;
1622
1623         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1624         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1625         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1626
1627         /* Schedule interrupt manually, if busy. */
1628         if (beacon0_valid && beacon1_valid) {
1629                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1630                 dev->irq_mask |= B43_IRQ_BEACON;
1631                 return;
1632         }
1633
1634         if (unlikely(wl->beacon_templates_virgin)) {
1635                 /* We never uploaded a beacon before.
1636                  * Upload both templates now, but only mark one valid. */
1637                 wl->beacon_templates_virgin = 0;
1638                 b43_upload_beacon0(dev);
1639                 b43_upload_beacon1(dev);
1640                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1641                 cmd |= B43_MACCMD_BEACON0_VALID;
1642                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1643         } else {
1644                 if (!beacon0_valid) {
1645                         b43_upload_beacon0(dev);
1646                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1647                         cmd |= B43_MACCMD_BEACON0_VALID;
1648                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1649                 } else if (!beacon1_valid) {
1650                         b43_upload_beacon1(dev);
1651                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1652                         cmd |= B43_MACCMD_BEACON1_VALID;
1653                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1654                 }
1655         }
1656 }
1657
1658 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1659 {
1660         u32 old_irq_mask = dev->irq_mask;
1661
1662         /* update beacon right away or defer to irq */
1663         handle_irq_beacon(dev);
1664         if (old_irq_mask != dev->irq_mask) {
1665                 /* The handler updated the IRQ mask. */
1666                 B43_WARN_ON(!dev->irq_mask);
1667                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1668                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1669                 } else {
1670                         /* Device interrupts are currently disabled. That means
1671                          * we just ran the hardirq handler and scheduled the
1672                          * IRQ thread. The thread will write the IRQ mask when
1673                          * it finished, so there's nothing to do here. Writing
1674                          * the mask _here_ would incorrectly re-enable IRQs. */
1675                 }
1676         }
1677 }
1678
1679 static void b43_beacon_update_trigger_work(struct work_struct *work)
1680 {
1681         struct b43_wl *wl = container_of(work, struct b43_wl,
1682                                          beacon_update_trigger);
1683         struct b43_wldev *dev;
1684
1685         mutex_lock(&wl->mutex);
1686         dev = wl->current_dev;
1687         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1688                 if (b43_bus_host_is_sdio(dev->dev)) {
1689                         /* wl->mutex is enough. */
1690                         b43_do_beacon_update_trigger_work(dev);
1691                         mmiowb();
1692                 } else {
1693                         spin_lock_irq(&wl->hardirq_lock);
1694                         b43_do_beacon_update_trigger_work(dev);
1695                         mmiowb();
1696                         spin_unlock_irq(&wl->hardirq_lock);
1697                 }
1698         }
1699         mutex_unlock(&wl->mutex);
1700 }
1701
1702 /* Asynchronously update the packet templates in template RAM.
1703  * Locking: Requires wl->mutex to be locked. */
1704 static void b43_update_templates(struct b43_wl *wl)
1705 {
1706         struct sk_buff *beacon;
1707
1708         /* This is the top half of the ansynchronous beacon update.
1709          * The bottom half is the beacon IRQ.
1710          * Beacon update must be asynchronous to avoid sending an
1711          * invalid beacon. This can happen for example, if the firmware
1712          * transmits a beacon while we are updating it. */
1713
1714         /* We could modify the existing beacon and set the aid bit in
1715          * the TIM field, but that would probably require resizing and
1716          * moving of data within the beacon template.
1717          * Simply request a new beacon and let mac80211 do the hard work. */
1718         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1719         if (unlikely(!beacon))
1720                 return;
1721
1722         if (wl->current_beacon)
1723                 dev_kfree_skb_any(wl->current_beacon);
1724         wl->current_beacon = beacon;
1725         wl->beacon0_uploaded = 0;
1726         wl->beacon1_uploaded = 0;
1727         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1728 }
1729
1730 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1731 {
1732         b43_time_lock(dev);
1733         if (dev->dev->core_rev >= 3) {
1734                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1735                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1736         } else {
1737                 b43_write16(dev, 0x606, (beacon_int >> 6));
1738                 b43_write16(dev, 0x610, beacon_int);
1739         }
1740         b43_time_unlock(dev);
1741         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1742 }
1743
1744 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1745 {
1746         u16 reason;
1747
1748         /* Read the register that contains the reason code for the panic. */
1749         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1750         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1751
1752         switch (reason) {
1753         default:
1754                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1755                 /* fallthrough */
1756         case B43_FWPANIC_DIE:
1757                 /* Do not restart the controller or firmware.
1758                  * The device is nonfunctional from now on.
1759                  * Restarting would result in this panic to trigger again,
1760                  * so we avoid that recursion. */
1761                 break;
1762         case B43_FWPANIC_RESTART:
1763                 b43_controller_restart(dev, "Microcode panic");
1764                 break;
1765         }
1766 }
1767
1768 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1769 {
1770         unsigned int i, cnt;
1771         u16 reason, marker_id, marker_line;
1772         __le16 *buf;
1773
1774         /* The proprietary firmware doesn't have this IRQ. */
1775         if (!dev->fw.opensource)
1776                 return;
1777
1778         /* Read the register that contains the reason code for this IRQ. */
1779         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1780
1781         switch (reason) {
1782         case B43_DEBUGIRQ_PANIC:
1783                 b43_handle_firmware_panic(dev);
1784                 break;
1785         case B43_DEBUGIRQ_DUMP_SHM:
1786                 if (!B43_DEBUG)
1787                         break; /* Only with driver debugging enabled. */
1788                 buf = kmalloc(4096, GFP_ATOMIC);
1789                 if (!buf) {
1790                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1791                         goto out;
1792                 }
1793                 for (i = 0; i < 4096; i += 2) {
1794                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1795                         buf[i / 2] = cpu_to_le16(tmp);
1796                 }
1797                 b43info(dev->wl, "Shared memory dump:\n");
1798                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1799                                16, 2, buf, 4096, 1);
1800                 kfree(buf);
1801                 break;
1802         case B43_DEBUGIRQ_DUMP_REGS:
1803                 if (!B43_DEBUG)
1804                         break; /* Only with driver debugging enabled. */
1805                 b43info(dev->wl, "Microcode register dump:\n");
1806                 for (i = 0, cnt = 0; i < 64; i++) {
1807                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1808                         if (cnt == 0)
1809                                 printk(KERN_INFO);
1810                         printk("r%02u: 0x%04X  ", i, tmp);
1811                         cnt++;
1812                         if (cnt == 6) {
1813                                 printk("\n");
1814                                 cnt = 0;
1815                         }
1816                 }
1817                 printk("\n");
1818                 break;
1819         case B43_DEBUGIRQ_MARKER:
1820                 if (!B43_DEBUG)
1821                         break; /* Only with driver debugging enabled. */
1822                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1823                                            B43_MARKER_ID_REG);
1824                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1825                                              B43_MARKER_LINE_REG);
1826                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1827                         "at line number %u\n",
1828                         marker_id, marker_line);
1829                 break;
1830         default:
1831                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1832                        reason);
1833         }
1834 out:
1835         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1836         b43_shm_write16(dev, B43_SHM_SCRATCH,
1837                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1838 }
1839
1840 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1841 {
1842         u32 reason;
1843         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1844         u32 merged_dma_reason = 0;
1845         int i;
1846
1847         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1848                 return;
1849
1850         reason = dev->irq_reason;
1851         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1852                 dma_reason[i] = dev->dma_reason[i];
1853                 merged_dma_reason |= dma_reason[i];
1854         }
1855
1856         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1857                 b43err(dev->wl, "MAC transmission error\n");
1858
1859         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1860                 b43err(dev->wl, "PHY transmission error\n");
1861                 rmb();
1862                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1863                         atomic_set(&dev->phy.txerr_cnt,
1864                                    B43_PHY_TX_BADNESS_LIMIT);
1865                         b43err(dev->wl, "Too many PHY TX errors, "
1866                                         "restarting the controller\n");
1867                         b43_controller_restart(dev, "PHY TX errors");
1868                 }
1869         }
1870
1871         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1872                                           B43_DMAIRQ_NONFATALMASK))) {
1873                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1874                         b43err(dev->wl, "Fatal DMA error: "
1875                                "0x%08X, 0x%08X, 0x%08X, "
1876                                "0x%08X, 0x%08X, 0x%08X\n",
1877                                dma_reason[0], dma_reason[1],
1878                                dma_reason[2], dma_reason[3],
1879                                dma_reason[4], dma_reason[5]);
1880                         b43err(dev->wl, "This device does not support DMA "
1881                                "on your system. It will now be switched to PIO.\n");
1882                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1883                         dev->use_pio = 1;
1884                         b43_controller_restart(dev, "DMA error");
1885                         return;
1886                 }
1887                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1888                         b43err(dev->wl, "DMA error: "
1889                                "0x%08X, 0x%08X, 0x%08X, "
1890                                "0x%08X, 0x%08X, 0x%08X\n",
1891                                dma_reason[0], dma_reason[1],
1892                                dma_reason[2], dma_reason[3],
1893                                dma_reason[4], dma_reason[5]);
1894                 }
1895         }
1896
1897         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1898                 handle_irq_ucode_debug(dev);
1899         if (reason & B43_IRQ_TBTT_INDI)
1900                 handle_irq_tbtt_indication(dev);
1901         if (reason & B43_IRQ_ATIM_END)
1902                 handle_irq_atim_end(dev);
1903         if (reason & B43_IRQ_BEACON)
1904                 handle_irq_beacon(dev);
1905         if (reason & B43_IRQ_PMQ)
1906                 handle_irq_pmq(dev);
1907         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1908                 ;/* TODO */
1909         if (reason & B43_IRQ_NOISESAMPLE_OK)
1910                 handle_irq_noise(dev);
1911
1912         /* Check the DMA reason registers for received data. */
1913         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1914                 if (b43_using_pio_transfers(dev))
1915                         b43_pio_rx(dev->pio.rx_queue);
1916                 else
1917                         b43_dma_rx(dev->dma.rx_ring);
1918         }
1919         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1920         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1921         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1922         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1923         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1924
1925         if (reason & B43_IRQ_TX_OK)
1926                 handle_irq_transmit_status(dev);
1927
1928         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1929         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1930
1931 #if B43_DEBUG
1932         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1933                 dev->irq_count++;
1934                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1935                         if (reason & (1 << i))
1936                                 dev->irq_bit_count[i]++;
1937                 }
1938         }
1939 #endif
1940 }
1941
1942 /* Interrupt thread handler. Handles device interrupts in thread context. */
1943 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1944 {
1945         struct b43_wldev *dev = dev_id;
1946
1947         mutex_lock(&dev->wl->mutex);
1948         b43_do_interrupt_thread(dev);
1949         mmiowb();
1950         mutex_unlock(&dev->wl->mutex);
1951
1952         return IRQ_HANDLED;
1953 }
1954
1955 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1956 {
1957         u32 reason;
1958
1959         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1960          * On SDIO, this runs under wl->mutex. */
1961
1962         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1963         if (reason == 0xffffffff)       /* shared IRQ */
1964                 return IRQ_NONE;
1965         reason &= dev->irq_mask;
1966         if (!reason)
1967                 return IRQ_HANDLED;
1968
1969         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1970             & 0x0001DC00;
1971         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1972             & 0x0000DC00;
1973         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1974             & 0x0000DC00;
1975         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1976             & 0x0001DC00;
1977         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1978             & 0x0000DC00;
1979 /* Unused ring
1980         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1981             & 0x0000DC00;
1982 */
1983
1984         /* ACK the interrupt. */
1985         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1986         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1987         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1988         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1989         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1990         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1991 /* Unused ring
1992         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1993 */
1994
1995         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1996         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1997         /* Save the reason bitmasks for the IRQ thread handler. */
1998         dev->irq_reason = reason;
1999
2000         return IRQ_WAKE_THREAD;
2001 }
2002
2003 /* Interrupt handler top-half. This runs with interrupts disabled. */
2004 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2005 {
2006         struct b43_wldev *dev = dev_id;
2007         irqreturn_t ret;
2008
2009         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2010                 return IRQ_NONE;
2011
2012         spin_lock(&dev->wl->hardirq_lock);
2013         ret = b43_do_interrupt(dev);
2014         mmiowb();
2015         spin_unlock(&dev->wl->hardirq_lock);
2016
2017         return ret;
2018 }
2019
2020 /* SDIO interrupt handler. This runs in process context. */
2021 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2022 {
2023         struct b43_wl *wl = dev->wl;
2024         irqreturn_t ret;
2025
2026         mutex_lock(&wl->mutex);
2027
2028         ret = b43_do_interrupt(dev);
2029         if (ret == IRQ_WAKE_THREAD)
2030                 b43_do_interrupt_thread(dev);
2031
2032         mutex_unlock(&wl->mutex);
2033 }
2034
2035 void b43_do_release_fw(struct b43_firmware_file *fw)
2036 {
2037         release_firmware(fw->data);
2038         fw->data = NULL;
2039         fw->filename = NULL;
2040 }
2041
2042 static void b43_release_firmware(struct b43_wldev *dev)
2043 {
2044         b43_do_release_fw(&dev->fw.ucode);
2045         b43_do_release_fw(&dev->fw.pcm);
2046         b43_do_release_fw(&dev->fw.initvals);
2047         b43_do_release_fw(&dev->fw.initvals_band);
2048 }
2049
2050 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2051 {
2052         const char text[] =
2053                 "You must go to " \
2054                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2055                 "and download the correct firmware for this driver version. " \
2056                 "Please carefully read all instructions on this website.\n";
2057
2058         if (error)
2059                 b43err(wl, text);
2060         else
2061                 b43warn(wl, text);
2062 }
2063
2064 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2065                       const char *name,
2066                       struct b43_firmware_file *fw)
2067 {
2068         const struct firmware *blob;
2069         struct b43_fw_header *hdr;
2070         u32 size;
2071         int err;
2072
2073         if (!name) {
2074                 /* Don't fetch anything. Free possibly cached firmware. */
2075                 /* FIXME: We should probably keep it anyway, to save some headache
2076                  * on suspend/resume with multiband devices. */
2077                 b43_do_release_fw(fw);
2078                 return 0;
2079         }
2080         if (fw->filename) {
2081                 if ((fw->type == ctx->req_type) &&
2082                     (strcmp(fw->filename, name) == 0))
2083                         return 0; /* Already have this fw. */
2084                 /* Free the cached firmware first. */
2085                 /* FIXME: We should probably do this later after we successfully
2086                  * got the new fw. This could reduce headache with multiband devices.
2087                  * We could also redesign this to cache the firmware for all possible
2088                  * bands all the time. */
2089                 b43_do_release_fw(fw);
2090         }
2091
2092         switch (ctx->req_type) {
2093         case B43_FWTYPE_PROPRIETARY:
2094                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2095                          "b43%s/%s.fw",
2096                          modparam_fwpostfix, name);
2097                 break;
2098         case B43_FWTYPE_OPENSOURCE:
2099                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2100                          "b43-open%s/%s.fw",
2101                          modparam_fwpostfix, name);
2102                 break;
2103         default:
2104                 B43_WARN_ON(1);
2105                 return -ENOSYS;
2106         }
2107         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2108         if (err == -ENOENT) {
2109                 snprintf(ctx->errors[ctx->req_type],
2110                          sizeof(ctx->errors[ctx->req_type]),
2111                          "Firmware file \"%s\" not found\n", ctx->fwname);
2112                 return err;
2113         } else if (err) {
2114                 snprintf(ctx->errors[ctx->req_type],
2115                          sizeof(ctx->errors[ctx->req_type]),
2116                          "Firmware file \"%s\" request failed (err=%d)\n",
2117                          ctx->fwname, err);
2118                 return err;
2119         }
2120         if (blob->size < sizeof(struct b43_fw_header))
2121                 goto err_format;
2122         hdr = (struct b43_fw_header *)(blob->data);
2123         switch (hdr->type) {
2124         case B43_FW_TYPE_UCODE:
2125         case B43_FW_TYPE_PCM:
2126                 size = be32_to_cpu(hdr->size);
2127                 if (size != blob->size - sizeof(struct b43_fw_header))
2128                         goto err_format;
2129                 /* fallthrough */
2130         case B43_FW_TYPE_IV:
2131                 if (hdr->ver != 1)
2132                         goto err_format;
2133                 break;
2134         default:
2135                 goto err_format;
2136         }
2137
2138         fw->data = blob;
2139         fw->filename = name;
2140         fw->type = ctx->req_type;
2141
2142         return 0;
2143
2144 err_format:
2145         snprintf(ctx->errors[ctx->req_type],
2146                  sizeof(ctx->errors[ctx->req_type]),
2147                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2148         release_firmware(blob);
2149
2150         return -EPROTO;
2151 }
2152
2153 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2154 {
2155         struct b43_wldev *dev = ctx->dev;
2156         struct b43_firmware *fw = &ctx->dev->fw;
2157         const u8 rev = ctx->dev->dev->core_rev;
2158         const char *filename;
2159         u32 tmshigh;
2160         int err;
2161
2162         /* Get microcode */
2163         if ((rev >= 5) && (rev <= 10))
2164                 filename = "ucode5";
2165         else if ((rev >= 11) && (rev <= 12))
2166                 filename = "ucode11";
2167         else if (rev == 13)
2168                 filename = "ucode13";
2169         else if (rev == 14)
2170                 filename = "ucode14";
2171         else if (rev == 15)
2172                 filename = "ucode15";
2173         else if ((rev >= 16) && (rev <= 20))
2174                 filename = "ucode16_mimo";
2175         else
2176                 goto err_no_ucode;
2177         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2178         if (err)
2179                 goto err_load;
2180
2181         /* Get PCM code */
2182         if ((rev >= 5) && (rev <= 10))
2183                 filename = "pcm5";
2184         else if (rev >= 11)
2185                 filename = NULL;
2186         else
2187                 goto err_no_pcm;
2188         fw->pcm_request_failed = 0;
2189         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2190         if (err == -ENOENT) {
2191                 /* We did not find a PCM file? Not fatal, but
2192                  * core rev <= 10 must do without hwcrypto then. */
2193                 fw->pcm_request_failed = 1;
2194         } else if (err)
2195                 goto err_load;
2196
2197         /* Get initvals */
2198         switch (dev->phy.type) {
2199         case B43_PHYTYPE_A:
2200                 if ((rev >= 5) && (rev <= 10)) {
2201                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2202                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2203                                 filename = "a0g1initvals5";
2204                         else
2205                                 filename = "a0g0initvals5";
2206                 } else
2207                         goto err_no_initvals;
2208                 break;
2209         case B43_PHYTYPE_G:
2210                 if ((rev >= 5) && (rev <= 10))
2211                         filename = "b0g0initvals5";
2212                 else if (rev >= 13)
2213                         filename = "b0g0initvals13";
2214                 else
2215                         goto err_no_initvals;
2216                 break;
2217         case B43_PHYTYPE_N:
2218                 if (rev >= 16)
2219                         filename = "n0initvals16";
2220                 else if ((rev >= 11) && (rev <= 12))
2221                         filename = "n0initvals11";
2222                 else
2223                         goto err_no_initvals;
2224                 break;
2225         case B43_PHYTYPE_LP:
2226                 if (rev == 13)
2227                         filename = "lp0initvals13";
2228                 else if (rev == 14)
2229                         filename = "lp0initvals14";
2230                 else if (rev >= 15)
2231                         filename = "lp0initvals15";
2232                 else
2233                         goto err_no_initvals;
2234                 break;
2235         default:
2236                 goto err_no_initvals;
2237         }
2238         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2239         if (err)
2240                 goto err_load;
2241
2242         /* Get bandswitch initvals */
2243         switch (dev->phy.type) {
2244         case B43_PHYTYPE_A:
2245                 if ((rev >= 5) && (rev <= 10)) {
2246                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2247                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2248                                 filename = "a0g1bsinitvals5";
2249                         else
2250                                 filename = "a0g0bsinitvals5";
2251                 } else if (rev >= 11)
2252                         filename = NULL;
2253                 else
2254                         goto err_no_initvals;
2255                 break;
2256         case B43_PHYTYPE_G:
2257                 if ((rev >= 5) && (rev <= 10))
2258                         filename = "b0g0bsinitvals5";
2259                 else if (rev >= 11)
2260                         filename = NULL;
2261                 else
2262                         goto err_no_initvals;
2263                 break;
2264         case B43_PHYTYPE_N:
2265                 if (rev >= 16)
2266                         filename = "n0bsinitvals16";
2267                 else if ((rev >= 11) && (rev <= 12))
2268                         filename = "n0bsinitvals11";
2269                 else
2270                         goto err_no_initvals;
2271                 break;
2272         case B43_PHYTYPE_LP:
2273                 if (rev == 13)
2274                         filename = "lp0bsinitvals13";
2275                 else if (rev == 14)
2276                         filename = "lp0bsinitvals14";
2277                 else if (rev >= 15)
2278                         filename = "lp0bsinitvals15";
2279                 else
2280                         goto err_no_initvals;
2281                 break;
2282         default:
2283                 goto err_no_initvals;
2284         }
2285         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2286         if (err)
2287                 goto err_load;
2288
2289         return 0;
2290
2291 err_no_ucode:
2292         err = ctx->fatal_failure = -EOPNOTSUPP;
2293         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2294                "is required for your device (wl-core rev %u)\n", rev);
2295         goto error;
2296
2297 err_no_pcm:
2298         err = ctx->fatal_failure = -EOPNOTSUPP;
2299         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2300                "is required for your device (wl-core rev %u)\n", rev);
2301         goto error;
2302
2303 err_no_initvals:
2304         err = ctx->fatal_failure = -EOPNOTSUPP;
2305         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2306                "is required for your device (wl-core rev %u)\n", rev);
2307         goto error;
2308
2309 err_load:
2310         /* We failed to load this firmware image. The error message
2311          * already is in ctx->errors. Return and let our caller decide
2312          * what to do. */
2313         goto error;
2314
2315 error:
2316         b43_release_firmware(dev);
2317         return err;
2318 }
2319
2320 static int b43_request_firmware(struct b43_wldev *dev)
2321 {
2322         struct b43_request_fw_context *ctx;
2323         unsigned int i;
2324         int err;
2325         const char *errmsg;
2326
2327         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2328         if (!ctx)
2329                 return -ENOMEM;
2330         ctx->dev = dev;
2331
2332         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2333         err = b43_try_request_fw(ctx);
2334         if (!err)
2335                 goto out; /* Successfully loaded it. */
2336         err = ctx->fatal_failure;
2337         if (err)
2338                 goto out;
2339
2340         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2341         err = b43_try_request_fw(ctx);
2342         if (!err)
2343                 goto out; /* Successfully loaded it. */
2344         err = ctx->fatal_failure;
2345         if (err)
2346                 goto out;
2347
2348         /* Could not find a usable firmware. Print the errors. */
2349         for (i = 0; i < B43_NR_FWTYPES; i++) {
2350                 errmsg = ctx->errors[i];
2351                 if (strlen(errmsg))
2352                         b43err(dev->wl, errmsg);
2353         }
2354         b43_print_fw_helptext(dev->wl, 1);
2355         err = -ENOENT;
2356
2357 out:
2358         kfree(ctx);
2359         return err;
2360 }
2361
2362 static int b43_upload_microcode(struct b43_wldev *dev)
2363 {
2364         struct wiphy *wiphy = dev->wl->hw->wiphy;
2365         const size_t hdr_len = sizeof(struct b43_fw_header);
2366         const __be32 *data;
2367         unsigned int i, len;
2368         u16 fwrev, fwpatch, fwdate, fwtime;
2369         u32 tmp, macctl;
2370         int err = 0;
2371
2372         /* Jump the microcode PSM to offset 0 */
2373         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2374         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2375         macctl |= B43_MACCTL_PSM_JMP0;
2376         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2377         /* Zero out all microcode PSM registers and shared memory. */
2378         for (i = 0; i < 64; i++)
2379                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2380         for (i = 0; i < 4096; i += 2)
2381                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2382
2383         /* Upload Microcode. */
2384         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2385         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2386         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2387         for (i = 0; i < len; i++) {
2388                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2389                 udelay(10);
2390         }
2391
2392         if (dev->fw.pcm.data) {
2393                 /* Upload PCM data. */
2394                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2395                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2396                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2397                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2398                 /* No need for autoinc bit in SHM_HW */
2399                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2400                 for (i = 0; i < len; i++) {
2401                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2402                         udelay(10);
2403                 }
2404         }
2405
2406         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2407
2408         /* Start the microcode PSM */
2409         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2410         macctl &= ~B43_MACCTL_PSM_JMP0;
2411         macctl |= B43_MACCTL_PSM_RUN;
2412         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2413
2414         /* Wait for the microcode to load and respond */
2415         i = 0;
2416         while (1) {
2417                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2418                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2419                         break;
2420                 i++;
2421                 if (i >= 20) {
2422                         b43err(dev->wl, "Microcode not responding\n");
2423                         b43_print_fw_helptext(dev->wl, 1);
2424                         err = -ENODEV;
2425                         goto error;
2426                 }
2427                 msleep(50);
2428         }
2429         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2430
2431         /* Get and check the revisions. */
2432         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2433         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2434         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2435         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2436
2437         if (fwrev <= 0x128) {
2438                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2439                        "binary drivers older than version 4.x is unsupported. "
2440                        "You must upgrade your firmware files.\n");
2441                 b43_print_fw_helptext(dev->wl, 1);
2442                 err = -EOPNOTSUPP;
2443                 goto error;
2444         }
2445         dev->fw.rev = fwrev;
2446         dev->fw.patch = fwpatch;
2447         dev->fw.opensource = (fwdate == 0xFFFF);
2448
2449         /* Default to use-all-queues. */
2450         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2451         dev->qos_enabled = !!modparam_qos;
2452         /* Default to firmware/hardware crypto acceleration. */
2453         dev->hwcrypto_enabled = 1;
2454
2455         if (dev->fw.opensource) {
2456                 u16 fwcapa;
2457
2458                 /* Patchlevel info is encoded in the "time" field. */
2459                 dev->fw.patch = fwtime;
2460                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2461                         dev->fw.rev, dev->fw.patch);
2462
2463                 fwcapa = b43_fwcapa_read(dev);
2464                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2465                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2466                         /* Disable hardware crypto and fall back to software crypto. */
2467                         dev->hwcrypto_enabled = 0;
2468                 }
2469                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2470                         b43info(dev->wl, "QoS not supported by firmware\n");
2471                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2472                          * ieee80211_unregister to make sure the networking core can
2473                          * properly free possible resources. */
2474                         dev->wl->hw->queues = 1;
2475                         dev->qos_enabled = 0;
2476                 }
2477         } else {
2478                 b43info(dev->wl, "Loading firmware version %u.%u "
2479                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2480                         fwrev, fwpatch,
2481                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2482                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2483                 if (dev->fw.pcm_request_failed) {
2484                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2485                                 "Hardware accelerated cryptography is disabled.\n");
2486                         b43_print_fw_helptext(dev->wl, 0);
2487                 }
2488         }
2489
2490         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2491                         dev->fw.rev, dev->fw.patch);
2492         wiphy->hw_version = dev->dev->core_id;
2493
2494         if (b43_is_old_txhdr_format(dev)) {
2495                 /* We're over the deadline, but we keep support for old fw
2496                  * until it turns out to be in major conflict with something new. */
2497                 b43warn(dev->wl, "You are using an old firmware image. "
2498                         "Support for old firmware will be removed soon "
2499                         "(official deadline was July 2008).\n");
2500                 b43_print_fw_helptext(dev->wl, 0);
2501         }
2502
2503         return 0;
2504
2505 error:
2506         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2507         macctl &= ~B43_MACCTL_PSM_RUN;
2508         macctl |= B43_MACCTL_PSM_JMP0;
2509         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2510
2511         return err;
2512 }
2513
2514 static int b43_write_initvals(struct b43_wldev *dev,
2515                               const struct b43_iv *ivals,
2516                               size_t count,
2517                               size_t array_size)
2518 {
2519         const struct b43_iv *iv;
2520         u16 offset;
2521         size_t i;
2522         bool bit32;
2523
2524         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2525         iv = ivals;
2526         for (i = 0; i < count; i++) {
2527                 if (array_size < sizeof(iv->offset_size))
2528                         goto err_format;
2529                 array_size -= sizeof(iv->offset_size);
2530                 offset = be16_to_cpu(iv->offset_size);
2531                 bit32 = !!(offset & B43_IV_32BIT);
2532                 offset &= B43_IV_OFFSET_MASK;
2533                 if (offset >= 0x1000)
2534                         goto err_format;
2535                 if (bit32) {
2536                         u32 value;
2537
2538                         if (array_size < sizeof(iv->data.d32))
2539                                 goto err_format;
2540                         array_size -= sizeof(iv->data.d32);
2541
2542                         value = get_unaligned_be32(&iv->data.d32);
2543                         b43_write32(dev, offset, value);
2544
2545                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2546                                                         sizeof(__be16) +
2547                                                         sizeof(__be32));
2548                 } else {
2549                         u16 value;
2550
2551                         if (array_size < sizeof(iv->data.d16))
2552                                 goto err_format;
2553                         array_size -= sizeof(iv->data.d16);
2554
2555                         value = be16_to_cpu(iv->data.d16);
2556                         b43_write16(dev, offset, value);
2557
2558                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2559                                                         sizeof(__be16) +
2560                                                         sizeof(__be16));
2561                 }
2562         }
2563         if (array_size)
2564                 goto err_format;
2565
2566         return 0;
2567
2568 err_format:
2569         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2570         b43_print_fw_helptext(dev->wl, 1);
2571
2572         return -EPROTO;
2573 }
2574
2575 static int b43_upload_initvals(struct b43_wldev *dev)
2576 {
2577         const size_t hdr_len = sizeof(struct b43_fw_header);
2578         const struct b43_fw_header *hdr;
2579         struct b43_firmware *fw = &dev->fw;
2580         const struct b43_iv *ivals;
2581         size_t count;
2582         int err;
2583
2584         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2585         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2586         count = be32_to_cpu(hdr->size);
2587         err = b43_write_initvals(dev, ivals, count,
2588                                  fw->initvals.data->size - hdr_len);
2589         if (err)
2590                 goto out;
2591         if (fw->initvals_band.data) {
2592                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2593                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2594                 count = be32_to_cpu(hdr->size);
2595                 err = b43_write_initvals(dev, ivals, count,
2596                                          fw->initvals_band.data->size - hdr_len);
2597                 if (err)
2598                         goto out;
2599         }
2600 out:
2601
2602         return err;
2603 }
2604
2605 /* Initialize the GPIOs
2606  * http://bcm-specs.sipsolutions.net/GPIO
2607  */
2608 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2609 {
2610         struct ssb_bus *bus = dev->dev->sdev->bus;
2611
2612 #ifdef CONFIG_SSB_DRIVER_PCICORE
2613         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2614 #else
2615         return bus->chipco.dev;
2616 #endif
2617 }
2618
2619 static int b43_gpio_init(struct b43_wldev *dev)
2620 {
2621         struct ssb_device *gpiodev;
2622         u32 mask, set;
2623
2624         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2625                     & ~B43_MACCTL_GPOUTSMSK);
2626
2627         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2628                     | 0x000F);
2629
2630         mask = 0x0000001F;
2631         set = 0x0000000F;
2632         if (dev->dev->chip_id == 0x4301) {
2633                 mask |= 0x0060;
2634                 set |= 0x0060;
2635         }
2636         if (0 /* FIXME: conditional unknown */ ) {
2637                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2638                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2639                             | 0x0100);
2640                 mask |= 0x0180;
2641                 set |= 0x0180;
2642         }
2643         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2644                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2645                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2646                             | 0x0200);
2647                 mask |= 0x0200;
2648                 set |= 0x0200;
2649         }
2650         if (dev->dev->core_rev >= 2)
2651                 mask |= 0x0010; /* FIXME: This is redundant. */
2652
2653         switch (dev->dev->bus_type) {
2654 #ifdef CONFIG_B43_BCMA
2655         case B43_BUS_BCMA:
2656                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2657                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2658                                         BCMA_CC_GPIOCTL) & mask) | set);
2659                 break;
2660 #endif
2661 #ifdef CONFIG_B43_SSB
2662         case B43_BUS_SSB:
2663                 gpiodev = b43_ssb_gpio_dev(dev);
2664                 if (gpiodev)
2665                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2666                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2667                                     & mask) | set);
2668                 break;
2669 #endif
2670         }
2671
2672         return 0;
2673 }
2674
2675 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2676 static void b43_gpio_cleanup(struct b43_wldev *dev)
2677 {
2678         struct ssb_device *gpiodev;
2679
2680         switch (dev->dev->bus_type) {
2681 #ifdef CONFIG_B43_BCMA
2682         case B43_BUS_BCMA:
2683                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2684                                 0);
2685                 break;
2686 #endif
2687 #ifdef CONFIG_B43_SSB
2688         case B43_BUS_SSB:
2689                 gpiodev = b43_ssb_gpio_dev(dev);
2690                 if (gpiodev)
2691                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2692                 break;
2693 #endif
2694         }
2695 }
2696
2697 /* http://bcm-specs.sipsolutions.net/EnableMac */
2698 void b43_mac_enable(struct b43_wldev *dev)
2699 {
2700         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2701                 u16 fwstate;
2702
2703                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2704                                          B43_SHM_SH_UCODESTAT);
2705                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2706                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2707                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2708                                "should be suspended, but current state is %u\n",
2709                                fwstate);
2710                 }
2711         }
2712
2713         dev->mac_suspended--;
2714         B43_WARN_ON(dev->mac_suspended < 0);
2715         if (dev->mac_suspended == 0) {
2716                 b43_write32(dev, B43_MMIO_MACCTL,
2717                             b43_read32(dev, B43_MMIO_MACCTL)
2718                             | B43_MACCTL_ENABLED);
2719                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2720                             B43_IRQ_MAC_SUSPENDED);
2721                 /* Commit writes */
2722                 b43_read32(dev, B43_MMIO_MACCTL);
2723                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2724                 b43_power_saving_ctl_bits(dev, 0);
2725         }
2726 }
2727
2728 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2729 void b43_mac_suspend(struct b43_wldev *dev)
2730 {
2731         int i;
2732         u32 tmp;
2733
2734         might_sleep();
2735         B43_WARN_ON(dev->mac_suspended < 0);
2736
2737         if (dev->mac_suspended == 0) {
2738                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2739                 b43_write32(dev, B43_MMIO_MACCTL,
2740                             b43_read32(dev, B43_MMIO_MACCTL)
2741                             & ~B43_MACCTL_ENABLED);
2742                 /* force pci to flush the write */
2743                 b43_read32(dev, B43_MMIO_MACCTL);
2744                 for (i = 35; i; i--) {
2745                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2746                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2747                                 goto out;
2748                         udelay(10);
2749                 }
2750                 /* Hm, it seems this will take some time. Use msleep(). */
2751                 for (i = 40; i; i--) {
2752                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2753                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2754                                 goto out;
2755                         msleep(1);
2756                 }
2757                 b43err(dev->wl, "MAC suspend failed\n");
2758         }
2759 out:
2760         dev->mac_suspended++;
2761 }
2762
2763 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2764 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2765 {
2766         u32 tmp;
2767
2768         switch (dev->dev->bus_type) {
2769 #ifdef CONFIG_B43_BCMA
2770         case B43_BUS_BCMA:
2771                 tmp = bcma_read32(dev->dev->bdev, BCMA_IOCTL);
2772                 if (on)
2773                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2774                 else
2775                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2776                 bcma_write32(dev->dev->bdev, BCMA_IOCTL, tmp);
2777                 break;
2778 #endif
2779 #ifdef CONFIG_B43_SSB
2780         case B43_BUS_SSB:
2781                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2782                 if (on)
2783                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2784                 else
2785                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2786                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2787                 break;
2788 #endif
2789         }
2790 }
2791
2792 static void b43_adjust_opmode(struct b43_wldev *dev)
2793 {
2794         struct b43_wl *wl = dev->wl;
2795         u32 ctl;
2796         u16 cfp_pretbtt;
2797
2798         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2799         /* Reset status to STA infrastructure mode. */
2800         ctl &= ~B43_MACCTL_AP;
2801         ctl &= ~B43_MACCTL_KEEP_CTL;
2802         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2803         ctl &= ~B43_MACCTL_KEEP_BAD;
2804         ctl &= ~B43_MACCTL_PROMISC;
2805         ctl &= ~B43_MACCTL_BEACPROMISC;
2806         ctl |= B43_MACCTL_INFRA;
2807
2808         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2809             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2810                 ctl |= B43_MACCTL_AP;
2811         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2812                 ctl &= ~B43_MACCTL_INFRA;
2813
2814         if (wl->filter_flags & FIF_CONTROL)
2815                 ctl |= B43_MACCTL_KEEP_CTL;
2816         if (wl->filter_flags & FIF_FCSFAIL)
2817                 ctl |= B43_MACCTL_KEEP_BAD;
2818         if (wl->filter_flags & FIF_PLCPFAIL)
2819                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2820         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2821                 ctl |= B43_MACCTL_PROMISC;
2822         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2823                 ctl |= B43_MACCTL_BEACPROMISC;
2824
2825         /* Workaround: On old hardware the HW-MAC-address-filter
2826          * doesn't work properly, so always run promisc in filter
2827          * it in software. */
2828         if (dev->dev->core_rev <= 4)
2829                 ctl |= B43_MACCTL_PROMISC;
2830
2831         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2832
2833         cfp_pretbtt = 2;
2834         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2835                 if (dev->dev->chip_id == 0x4306 &&
2836                     dev->dev->chip_rev == 3)
2837                         cfp_pretbtt = 100;
2838                 else
2839                         cfp_pretbtt = 50;
2840         }
2841         b43_write16(dev, 0x612, cfp_pretbtt);
2842
2843         /* FIXME: We don't currently implement the PMQ mechanism,
2844          *        so always disable it. If we want to implement PMQ,
2845          *        we need to enable it here (clear DISCPMQ) in AP mode.
2846          */
2847         if (0  /* ctl & B43_MACCTL_AP */) {
2848                 b43_write32(dev, B43_MMIO_MACCTL,
2849                             b43_read32(dev, B43_MMIO_MACCTL)
2850                             & ~B43_MACCTL_DISCPMQ);
2851         } else {
2852                 b43_write32(dev, B43_MMIO_MACCTL,
2853                             b43_read32(dev, B43_MMIO_MACCTL)
2854                             | B43_MACCTL_DISCPMQ);
2855         }
2856 }
2857
2858 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2859 {
2860         u16 offset;
2861
2862         if (is_ofdm) {
2863                 offset = 0x480;
2864                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2865         } else {
2866                 offset = 0x4C0;
2867                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2868         }
2869         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2870                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2871 }
2872
2873 static void b43_rate_memory_init(struct b43_wldev *dev)
2874 {
2875         switch (dev->phy.type) {
2876         case B43_PHYTYPE_A:
2877         case B43_PHYTYPE_G:
2878         case B43_PHYTYPE_N:
2879         case B43_PHYTYPE_LP:
2880                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2881                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2882                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2883                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2884                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2885                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2886                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2887                 if (dev->phy.type == B43_PHYTYPE_A)
2888                         break;
2889                 /* fallthrough */
2890         case B43_PHYTYPE_B:
2891                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2892                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2893                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2894                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2895                 break;
2896         default:
2897                 B43_WARN_ON(1);
2898         }
2899 }
2900
2901 /* Set the default values for the PHY TX Control Words. */
2902 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2903 {
2904         u16 ctl = 0;
2905
2906         ctl |= B43_TXH_PHY_ENC_CCK;
2907         ctl |= B43_TXH_PHY_ANT01AUTO;
2908         ctl |= B43_TXH_PHY_TXPWR;
2909
2910         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2911         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2912         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2913 }
2914
2915 /* Set the TX-Antenna for management frames sent by firmware. */
2916 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2917 {
2918         u16 ant;
2919         u16 tmp;
2920
2921         ant = b43_antenna_to_phyctl(antenna);
2922
2923         /* For ACK/CTS */
2924         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2925         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2926         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2927         /* For Probe Resposes */
2928         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2929         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2930         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2931 }
2932
2933 /* This is the opposite of b43_chip_init() */
2934 static void b43_chip_exit(struct b43_wldev *dev)
2935 {
2936         b43_phy_exit(dev);
2937         b43_gpio_cleanup(dev);
2938         /* firmware is released later */
2939 }
2940
2941 /* Initialize the chip
2942  * http://bcm-specs.sipsolutions.net/ChipInit
2943  */
2944 static int b43_chip_init(struct b43_wldev *dev)
2945 {
2946         struct b43_phy *phy = &dev->phy;
2947         int err;
2948         u32 macctl;
2949         u16 value16;
2950
2951         /* Initialize the MAC control */
2952         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2953         if (dev->phy.gmode)
2954                 macctl |= B43_MACCTL_GMODE;
2955         macctl |= B43_MACCTL_INFRA;
2956         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2957
2958         err = b43_request_firmware(dev);
2959         if (err)
2960                 goto out;
2961         err = b43_upload_microcode(dev);
2962         if (err)
2963                 goto out;       /* firmware is released later */
2964
2965         err = b43_gpio_init(dev);
2966         if (err)
2967                 goto out;       /* firmware is released later */
2968
2969         err = b43_upload_initvals(dev);
2970         if (err)
2971                 goto err_gpio_clean;
2972
2973         /* Turn the Analog on and initialize the PHY. */
2974         phy->ops->switch_analog(dev, 1);
2975         err = b43_phy_init(dev);
2976         if (err)
2977                 goto err_gpio_clean;
2978
2979         /* Disable Interference Mitigation. */
2980         if (phy->ops->interf_mitigation)
2981                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2982
2983         /* Select the antennae */
2984         if (phy->ops->set_rx_antenna)
2985                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2986         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2987
2988         if (phy->type == B43_PHYTYPE_B) {
2989                 value16 = b43_read16(dev, 0x005E);
2990                 value16 |= 0x0004;
2991                 b43_write16(dev, 0x005E, value16);
2992         }
2993         b43_write32(dev, 0x0100, 0x01000000);
2994         if (dev->dev->core_rev < 5)
2995                 b43_write32(dev, 0x010C, 0x01000000);
2996
2997         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2998                     & ~B43_MACCTL_INFRA);
2999         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3000                     | B43_MACCTL_INFRA);
3001
3002         /* Probe Response Timeout value */
3003         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3004         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3005
3006         /* Initially set the wireless operation mode. */
3007         b43_adjust_opmode(dev);
3008
3009         if (dev->dev->core_rev < 3) {
3010                 b43_write16(dev, 0x060E, 0x0000);
3011                 b43_write16(dev, 0x0610, 0x8000);
3012                 b43_write16(dev, 0x0604, 0x0000);
3013                 b43_write16(dev, 0x0606, 0x0200);
3014         } else {
3015                 b43_write32(dev, 0x0188, 0x80000000);
3016                 b43_write32(dev, 0x018C, 0x02000000);
3017         }
3018         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3019         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3020         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3021         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3022         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3023         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3024         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3025
3026         b43_mac_phy_clock_set(dev, true);
3027
3028         switch (dev->dev->bus_type) {
3029 #ifdef CONFIG_B43_BCMA
3030         case B43_BUS_BCMA:
3031                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3032                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3033                 break;
3034 #endif
3035 #ifdef CONFIG_B43_SSB
3036         case B43_BUS_SSB:
3037                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3038                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3039                 break;
3040 #endif
3041         }
3042
3043         err = 0;
3044         b43dbg(dev->wl, "Chip initialized\n");
3045 out:
3046         return err;
3047
3048 err_gpio_clean:
3049         b43_gpio_cleanup(dev);
3050         return err;
3051 }
3052
3053 static void b43_periodic_every60sec(struct b43_wldev *dev)
3054 {
3055         const struct b43_phy_operations *ops = dev->phy.ops;
3056
3057         if (ops->pwork_60sec)
3058                 ops->pwork_60sec(dev);
3059
3060         /* Force check the TX power emission now. */
3061         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3062 }
3063
3064 static void b43_periodic_every30sec(struct b43_wldev *dev)
3065 {
3066         /* Update device statistics. */
3067         b43_calculate_link_quality(dev);
3068 }
3069
3070 static void b43_periodic_every15sec(struct b43_wldev *dev)
3071 {
3072         struct b43_phy *phy = &dev->phy;
3073         u16 wdr;
3074
3075         if (dev->fw.opensource) {
3076                 /* Check if the firmware is still alive.
3077                  * It will reset the watchdog counter to 0 in its idle loop. */
3078                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3079                 if (unlikely(wdr)) {
3080                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3081                         b43_controller_restart(dev, "Firmware watchdog");
3082                         return;
3083                 } else {
3084                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3085                                         B43_WATCHDOG_REG, 1);
3086                 }
3087         }
3088
3089         if (phy->ops->pwork_15sec)
3090                 phy->ops->pwork_15sec(dev);
3091
3092         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3093         wmb();
3094
3095 #if B43_DEBUG
3096         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3097                 unsigned int i;
3098
3099                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3100                        dev->irq_count / 15,
3101                        dev->tx_count / 15,
3102                        dev->rx_count / 15);
3103                 dev->irq_count = 0;
3104                 dev->tx_count = 0;
3105                 dev->rx_count = 0;
3106                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3107                         if (dev->irq_bit_count[i]) {
3108                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3109                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3110                                 dev->irq_bit_count[i] = 0;
3111                         }
3112                 }
3113         }
3114 #endif
3115 }
3116
3117 static void do_periodic_work(struct b43_wldev *dev)
3118 {
3119         unsigned int state;
3120
3121         state = dev->periodic_state;
3122         if (state % 4 == 0)
3123                 b43_periodic_every60sec(dev);
3124         if (state % 2 == 0)
3125                 b43_periodic_every30sec(dev);
3126         b43_periodic_every15sec(dev);
3127 }
3128
3129 /* Periodic work locking policy:
3130  *      The whole periodic work handler is protected by
3131  *      wl->mutex. If another lock is needed somewhere in the
3132  *      pwork callchain, it's acquired in-place, where it's needed.
3133  */
3134 static void b43_periodic_work_handler(struct work_struct *work)
3135 {
3136         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3137                                              periodic_work.work);
3138         struct b43_wl *wl = dev->wl;
3139         unsigned long delay;
3140
3141         mutex_lock(&wl->mutex);
3142
3143         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3144                 goto out;
3145         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3146                 goto out_requeue;
3147
3148         do_periodic_work(dev);
3149
3150         dev->periodic_state++;
3151 out_requeue:
3152         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3153                 delay = msecs_to_jiffies(50);
3154         else
3155                 delay = round_jiffies_relative(HZ * 15);
3156         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3157 out:
3158         mutex_unlock(&wl->mutex);
3159 }
3160
3161 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3162 {
3163         struct delayed_work *work = &dev->periodic_work;
3164
3165         dev->periodic_state = 0;
3166         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3167         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3168 }
3169
3170 /* Check if communication with the device works correctly. */
3171 static int b43_validate_chipaccess(struct b43_wldev *dev)
3172 {
3173         u32 v, backup0, backup4;
3174
3175         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3176         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3177
3178         /* Check for read/write and endianness problems. */
3179         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3180         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3181                 goto error;
3182         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3183         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3184                 goto error;
3185
3186         /* Check if unaligned 32bit SHM_SHARED access works properly.
3187          * However, don't bail out on failure, because it's noncritical. */
3188         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3189         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3190         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3191         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3192         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3193                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3194         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3195         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3196             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3197             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3198             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3199                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3200
3201         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3202         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3203
3204         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3205                 /* The 32bit register shadows the two 16bit registers
3206                  * with update sideeffects. Validate this. */
3207                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3208                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3209                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3210                         goto error;
3211                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3212                         goto error;
3213         }
3214         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3215
3216         v = b43_read32(dev, B43_MMIO_MACCTL);
3217         v |= B43_MACCTL_GMODE;
3218         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3219                 goto error;
3220
3221         return 0;
3222 error:
3223         b43err(dev->wl, "Failed to validate the chipaccess\n");
3224         return -ENODEV;
3225 }
3226
3227 static void b43_security_init(struct b43_wldev *dev)
3228 {
3229         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3230         /* KTP is a word address, but we address SHM bytewise.
3231          * So multiply by two.
3232          */
3233         dev->ktp *= 2;
3234         /* Number of RCMTA address slots */
3235         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3236         /* Clear the key memory. */
3237         b43_clear_keys(dev);
3238 }
3239
3240 #ifdef CONFIG_B43_HWRNG
3241 static int b43_rng_read(struct hwrng *rng, u32 *data)
3242 {
3243         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3244         struct b43_wldev *dev;
3245         int count = -ENODEV;
3246
3247         mutex_lock(&wl->mutex);
3248         dev = wl->current_dev;
3249         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3250                 *data = b43_read16(dev, B43_MMIO_RNG);
3251                 count = sizeof(u16);
3252         }
3253         mutex_unlock(&wl->mutex);
3254
3255         return count;
3256 }
3257 #endif /* CONFIG_B43_HWRNG */
3258
3259 static void b43_rng_exit(struct b43_wl *wl)
3260 {
3261 #ifdef CONFIG_B43_HWRNG
3262         if (wl->rng_initialized)
3263                 hwrng_unregister(&wl->rng);
3264 #endif /* CONFIG_B43_HWRNG */
3265 }
3266
3267 static int b43_rng_init(struct b43_wl *wl)
3268 {
3269         int err = 0;
3270
3271 #ifdef CONFIG_B43_HWRNG
3272         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3273                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3274         wl->rng.name = wl->rng_name;
3275         wl->rng.data_read = b43_rng_read;
3276         wl->rng.priv = (unsigned long)wl;
3277         wl->rng_initialized = 1;
3278         err = hwrng_register(&wl->rng);
3279         if (err) {
3280                 wl->rng_initialized = 0;
3281                 b43err(wl, "Failed to register the random "
3282                        "number generator (%d)\n", err);
3283         }
3284 #endif /* CONFIG_B43_HWRNG */
3285
3286         return err;
3287 }
3288
3289 static void b43_tx_work(struct work_struct *work)
3290 {
3291         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3292         struct b43_wldev *dev;
3293         struct sk_buff *skb;
3294         int err = 0;
3295
3296         mutex_lock(&wl->mutex);
3297         dev = wl->current_dev;
3298         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3299                 mutex_unlock(&wl->mutex);
3300                 return;
3301         }
3302
3303         while (skb_queue_len(&wl->tx_queue)) {
3304                 skb = skb_dequeue(&wl->tx_queue);
3305
3306                 if (b43_using_pio_transfers(dev))
3307                         err = b43_pio_tx(dev, skb);
3308                 else
3309                         err = b43_dma_tx(dev, skb);
3310                 if (unlikely(err))
3311                         dev_kfree_skb(skb); /* Drop it */
3312         }
3313
3314 #if B43_DEBUG
3315         dev->tx_count++;
3316 #endif
3317         mutex_unlock(&wl->mutex);
3318 }
3319
3320 static void b43_op_tx(struct ieee80211_hw *hw,
3321                      struct sk_buff *skb)
3322 {
3323         struct b43_wl *wl = hw_to_b43_wl(hw);
3324
3325         if (unlikely(skb->len < 2 + 2 + 6)) {
3326                 /* Too short, this can't be a valid frame. */
3327                 dev_kfree_skb_any(skb);
3328                 return;
3329         }
3330         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3331
3332         skb_queue_tail(&wl->tx_queue, skb);
3333         ieee80211_queue_work(wl->hw, &wl->tx_work);
3334 }
3335
3336 static void b43_qos_params_upload(struct b43_wldev *dev,
3337                                   const struct ieee80211_tx_queue_params *p,
3338                                   u16 shm_offset)
3339 {
3340         u16 params[B43_NR_QOSPARAMS];
3341         int bslots, tmp;
3342         unsigned int i;
3343
3344         if (!dev->qos_enabled)
3345                 return;
3346
3347         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3348
3349         memset(&params, 0, sizeof(params));
3350
3351         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3352         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3353         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3354         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3355         params[B43_QOSPARAM_AIFS] = p->aifs;
3356         params[B43_QOSPARAM_BSLOTS] = bslots;
3357         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3358
3359         for (i = 0; i < ARRAY_SIZE(params); i++) {
3360                 if (i == B43_QOSPARAM_STATUS) {
3361                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3362                                              shm_offset + (i * 2));
3363                         /* Mark the parameters as updated. */
3364                         tmp |= 0x100;
3365                         b43_shm_write16(dev, B43_SHM_SHARED,
3366                                         shm_offset + (i * 2),
3367                                         tmp);
3368                 } else {
3369                         b43_shm_write16(dev, B43_SHM_SHARED,
3370                                         shm_offset + (i * 2),
3371                                         params[i]);
3372                 }
3373         }
3374 }
3375
3376 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3377 static const u16 b43_qos_shm_offsets[] = {
3378         /* [mac80211-queue-nr] = SHM_OFFSET, */
3379         [0] = B43_QOS_VOICE,
3380         [1] = B43_QOS_VIDEO,
3381         [2] = B43_QOS_BESTEFFORT,
3382         [3] = B43_QOS_BACKGROUND,
3383 };
3384
3385 /* Update all QOS parameters in hardware. */
3386 static void b43_qos_upload_all(struct b43_wldev *dev)
3387 {
3388         struct b43_wl *wl = dev->wl;
3389         struct b43_qos_params *params;
3390         unsigned int i;
3391
3392         if (!dev->qos_enabled)
3393                 return;
3394
3395         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3396                      ARRAY_SIZE(wl->qos_params));
3397
3398         b43_mac_suspend(dev);
3399         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3400                 params = &(wl->qos_params[i]);
3401                 b43_qos_params_upload(dev, &(params->p),
3402                                       b43_qos_shm_offsets[i]);
3403         }
3404         b43_mac_enable(dev);
3405 }
3406
3407 static void b43_qos_clear(struct b43_wl *wl)
3408 {
3409         struct b43_qos_params *params;
3410         unsigned int i;
3411
3412         /* Initialize QoS parameters to sane defaults. */
3413
3414         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3415                      ARRAY_SIZE(wl->qos_params));
3416
3417         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3418                 params = &(wl->qos_params[i]);
3419
3420                 switch (b43_qos_shm_offsets[i]) {
3421                 case B43_QOS_VOICE:
3422                         params->p.txop = 0;
3423                         params->p.aifs = 2;
3424                         params->p.cw_min = 0x0001;
3425                         params->p.cw_max = 0x0001;
3426                         break;
3427                 case B43_QOS_VIDEO:
3428                         params->p.txop = 0;
3429                         params->p.aifs = 2;
3430                         params->p.cw_min = 0x0001;
3431                         params->p.cw_max = 0x0001;
3432                         break;
3433                 case B43_QOS_BESTEFFORT:
3434                         params->p.txop = 0;
3435                         params->p.aifs = 3;
3436                         params->p.cw_min = 0x0001;
3437                         params->p.cw_max = 0x03FF;
3438                         break;
3439                 case B43_QOS_BACKGROUND:
3440                         params->p.txop = 0;
3441                         params->p.aifs = 7;
3442                         params->p.cw_min = 0x0001;
3443                         params->p.cw_max = 0x03FF;
3444                         break;
3445                 default:
3446                         B43_WARN_ON(1);
3447                 }
3448         }
3449 }
3450
3451 /* Initialize the core's QOS capabilities */
3452 static void b43_qos_init(struct b43_wldev *dev)
3453 {
3454         if (!dev->qos_enabled) {
3455                 /* Disable QOS support. */
3456                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3457                 b43_write16(dev, B43_MMIO_IFSCTL,
3458                             b43_read16(dev, B43_MMIO_IFSCTL)
3459                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3460                 b43dbg(dev->wl, "QoS disabled\n");
3461                 return;
3462         }
3463
3464         /* Upload the current QOS parameters. */
3465         b43_qos_upload_all(dev);
3466
3467         /* Enable QOS support. */
3468         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3469         b43_write16(dev, B43_MMIO_IFSCTL,
3470                     b43_read16(dev, B43_MMIO_IFSCTL)
3471                     | B43_MMIO_IFSCTL_USE_EDCF);
3472         b43dbg(dev->wl, "QoS enabled\n");
3473 }
3474
3475 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3476                           const struct ieee80211_tx_queue_params *params)
3477 {
3478         struct b43_wl *wl = hw_to_b43_wl(hw);
3479         struct b43_wldev *dev;
3480         unsigned int queue = (unsigned int)_queue;
3481         int err = -ENODEV;
3482
3483         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3484                 /* Queue not available or don't support setting
3485                  * params on this queue. Return success to not
3486                  * confuse mac80211. */
3487                 return 0;
3488         }
3489         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3490                      ARRAY_SIZE(wl->qos_params));
3491
3492         mutex_lock(&wl->mutex);
3493         dev = wl->current_dev;
3494         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3495                 goto out_unlock;
3496
3497         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3498         b43_mac_suspend(dev);
3499         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3500                               b43_qos_shm_offsets[queue]);
3501         b43_mac_enable(dev);
3502         err = 0;
3503
3504 out_unlock:
3505         mutex_unlock(&wl->mutex);
3506
3507         return err;
3508 }
3509
3510 static int b43_op_get_stats(struct ieee80211_hw *hw,
3511                             struct ieee80211_low_level_stats *stats)
3512 {
3513         struct b43_wl *wl = hw_to_b43_wl(hw);
3514
3515         mutex_lock(&wl->mutex);
3516         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3517         mutex_unlock(&wl->mutex);
3518
3519         return 0;
3520 }
3521
3522 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3523 {
3524         struct b43_wl *wl = hw_to_b43_wl(hw);
3525         struct b43_wldev *dev;
3526         u64 tsf;
3527
3528         mutex_lock(&wl->mutex);
3529         dev = wl->current_dev;
3530
3531         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3532                 b43_tsf_read(dev, &tsf);
3533         else
3534                 tsf = 0;
3535
3536         mutex_unlock(&wl->mutex);
3537
3538         return tsf;
3539 }
3540
3541 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3542 {
3543         struct b43_wl *wl = hw_to_b43_wl(hw);
3544         struct b43_wldev *dev;
3545
3546         mutex_lock(&wl->mutex);
3547         dev = wl->current_dev;
3548
3549         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3550                 b43_tsf_write(dev, tsf);
3551
3552         mutex_unlock(&wl->mutex);
3553 }
3554
3555 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3556 {
3557         u32 tmp;
3558
3559         switch (dev->dev->bus_type) {
3560 #ifdef CONFIG_B43_BCMA
3561         case B43_BUS_BCMA:
3562                 b43err(dev->wl,
3563                        "Putting PHY into reset not supported on BCMA\n");
3564                 break;
3565 #endif
3566 #ifdef CONFIG_B43_SSB
3567         case B43_BUS_SSB:
3568                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3569                 tmp &= ~B43_TMSLOW_GMODE;
3570                 tmp |= B43_TMSLOW_PHYRESET;
3571                 tmp |= SSB_TMSLOW_FGC;
3572                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3573                 msleep(1);
3574
3575                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3576                 tmp &= ~SSB_TMSLOW_FGC;
3577                 tmp |= B43_TMSLOW_PHYRESET;
3578                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3579                 msleep(1);
3580
3581                 break;
3582 #endif
3583         }
3584 }
3585
3586 static const char *band_to_string(enum ieee80211_band band)
3587 {
3588         switch (band) {
3589         case IEEE80211_BAND_5GHZ:
3590                 return "5";
3591         case IEEE80211_BAND_2GHZ:
3592                 return "2.4";
3593         default:
3594                 break;
3595         }
3596         B43_WARN_ON(1);
3597         return "";
3598 }
3599
3600 /* Expects wl->mutex locked */
3601 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3602 {
3603         struct b43_wldev *up_dev = NULL;
3604         struct b43_wldev *down_dev;
3605         struct b43_wldev *d;
3606         int err;
3607         bool uninitialized_var(gmode);
3608         int prev_status;
3609
3610         /* Find a device and PHY which supports the band. */
3611         list_for_each_entry(d, &wl->devlist, list) {
3612                 switch (chan->band) {
3613                 case IEEE80211_BAND_5GHZ:
3614                         if (d->phy.supports_5ghz) {
3615                                 up_dev = d;
3616                                 gmode = 0;
3617                         }
3618                         break;
3619                 case IEEE80211_BAND_2GHZ:
3620                         if (d->phy.supports_2ghz) {
3621                                 up_dev = d;
3622                                 gmode = 1;
3623                         }
3624                         break;
3625                 default:
3626                         B43_WARN_ON(1);
3627                         return -EINVAL;
3628                 }
3629                 if (up_dev)
3630                         break;
3631         }
3632         if (!up_dev) {
3633                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3634                        band_to_string(chan->band));
3635                 return -ENODEV;
3636         }
3637         if ((up_dev == wl->current_dev) &&
3638             (!!wl->current_dev->phy.gmode == !!gmode)) {
3639                 /* This device is already running. */
3640                 return 0;
3641         }
3642         b43dbg(wl, "Switching to %s-GHz band\n",
3643                band_to_string(chan->band));
3644         down_dev = wl->current_dev;
3645
3646         prev_status = b43_status(down_dev);
3647         /* Shutdown the currently running core. */
3648         if (prev_status >= B43_STAT_STARTED)
3649                 down_dev = b43_wireless_core_stop(down_dev);
3650         if (prev_status >= B43_STAT_INITIALIZED)
3651                 b43_wireless_core_exit(down_dev);
3652
3653         if (down_dev != up_dev) {
3654                 /* We switch to a different core, so we put PHY into
3655                  * RESET on the old core. */
3656                 b43_put_phy_into_reset(down_dev);
3657         }
3658
3659         /* Now start the new core. */
3660         up_dev->phy.gmode = gmode;
3661         if (prev_status >= B43_STAT_INITIALIZED) {
3662                 err = b43_wireless_core_init(up_dev);
3663                 if (err) {
3664                         b43err(wl, "Fatal: Could not initialize device for "
3665                                "selected %s-GHz band\n",
3666                                band_to_string(chan->band));
3667                         goto init_failure;
3668                 }
3669         }
3670         if (prev_status >= B43_STAT_STARTED) {
3671                 err = b43_wireless_core_start(up_dev);
3672                 if (err) {
3673                         b43err(wl, "Fatal: Coult not start device for "
3674                                "selected %s-GHz band\n",
3675                                band_to_string(chan->band));
3676                         b43_wireless_core_exit(up_dev);
3677                         goto init_failure;
3678                 }
3679         }
3680         B43_WARN_ON(b43_status(up_dev) != prev_status);
3681
3682         wl->current_dev = up_dev;
3683
3684         return 0;
3685 init_failure:
3686         /* Whoops, failed to init the new core. No core is operating now. */
3687         wl->current_dev = NULL;
3688         return err;
3689 }
3690
3691 /* Write the short and long frame retry limit values. */
3692 static void b43_set_retry_limits(struct b43_wldev *dev,
3693                                  unsigned int short_retry,
3694                                  unsigned int long_retry)
3695 {
3696         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3697          * the chip-internal counter. */
3698         short_retry = min(short_retry, (unsigned int)0xF);
3699         long_retry = min(long_retry, (unsigned int)0xF);
3700
3701         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3702                         short_retry);
3703         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3704                         long_retry);
3705 }
3706
3707 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3708 {
3709         struct b43_wl *wl = hw_to_b43_wl(hw);
3710         struct b43_wldev *dev;
3711         struct b43_phy *phy;
3712         struct ieee80211_conf *conf = &hw->conf;
3713         int antenna;
3714         int err = 0;
3715
3716         mutex_lock(&wl->mutex);
3717
3718         /* Switch the band (if necessary). This might change the active core. */
3719         err = b43_switch_band(wl, conf->channel);
3720         if (err)
3721                 goto out_unlock_mutex;
3722         dev = wl->current_dev;
3723         phy = &dev->phy;
3724
3725         if (conf_is_ht(conf))
3726                 phy->is_40mhz =
3727                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3728         else
3729                 phy->is_40mhz = false;
3730
3731         b43_mac_suspend(dev);
3732
3733         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3734                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3735                                           conf->long_frame_max_tx_count);
3736         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3737         if (!changed)
3738                 goto out_mac_enable;
3739
3740         /* Switch to the requested channel.
3741          * The firmware takes care of races with the TX handler. */
3742         if (conf->channel->hw_value != phy->channel)
3743                 b43_switch_channel(dev, conf->channel->hw_value);
3744
3745         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3746
3747         /* Adjust the desired TX power level. */
3748         if (conf->power_level != 0) {
3749                 if (conf->power_level != phy->desired_txpower) {
3750                         phy->desired_txpower = conf->power_level;
3751                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3752                                                    B43_TXPWR_IGNORE_TSSI);
3753                 }
3754         }
3755
3756         /* Antennas for RX and management frame TX. */
3757         antenna = B43_ANTENNA_DEFAULT;
3758         b43_mgmtframe_txantenna(dev, antenna);
3759         antenna = B43_ANTENNA_DEFAULT;
3760         if (phy->ops->set_rx_antenna)
3761                 phy->ops->set_rx_antenna(dev, antenna);
3762
3763         if (wl->radio_enabled != phy->radio_on) {
3764                 if (wl->radio_enabled) {
3765                         b43_software_rfkill(dev, false);
3766                         b43info(dev->wl, "Radio turned on by software\n");
3767                         if (!dev->radio_hw_enable) {
3768                                 b43info(dev->wl, "The hardware RF-kill button "
3769                                         "still turns the radio physically off. "
3770                                         "Press the button to turn it on.\n");
3771                         }
3772                 } else {
3773                         b43_software_rfkill(dev, true);
3774                         b43info(dev->wl, "Radio turned off by software\n");
3775                 }
3776         }
3777
3778 out_mac_enable:
3779         b43_mac_enable(dev);
3780 out_unlock_mutex:
3781         mutex_unlock(&wl->mutex);
3782
3783         return err;
3784 }
3785
3786 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3787 {
3788         struct ieee80211_supported_band *sband =
3789                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3790         struct ieee80211_rate *rate;
3791         int i;
3792         u16 basic, direct, offset, basic_offset, rateptr;
3793
3794         for (i = 0; i < sband->n_bitrates; i++) {
3795                 rate = &sband->bitrates[i];
3796
3797                 if (b43_is_cck_rate(rate->hw_value)) {
3798                         direct = B43_SHM_SH_CCKDIRECT;
3799                         basic = B43_SHM_SH_CCKBASIC;
3800                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3801                         offset &= 0xF;
3802                 } else {
3803                         direct = B43_SHM_SH_OFDMDIRECT;
3804                         basic = B43_SHM_SH_OFDMBASIC;
3805                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3806                         offset &= 0xF;
3807                 }
3808
3809                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3810
3811                 if (b43_is_cck_rate(rate->hw_value)) {
3812                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3813                         basic_offset &= 0xF;
3814                 } else {
3815                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3816                         basic_offset &= 0xF;
3817                 }
3818
3819                 /*
3820                  * Get the pointer that we need to point to
3821                  * from the direct map
3822                  */
3823                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3824                                          direct + 2 * basic_offset);
3825                 /* and write it to the basic map */
3826                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3827                                 rateptr);
3828         }
3829 }
3830
3831 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3832                                     struct ieee80211_vif *vif,
3833                                     struct ieee80211_bss_conf *conf,
3834                                     u32 changed)
3835 {
3836         struct b43_wl *wl = hw_to_b43_wl(hw);
3837         struct b43_wldev *dev;
3838
3839         mutex_lock(&wl->mutex);
3840
3841         dev = wl->current_dev;
3842         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3843                 goto out_unlock_mutex;
3844
3845         B43_WARN_ON(wl->vif != vif);
3846
3847         if (changed & BSS_CHANGED_BSSID) {
3848                 if (conf->bssid)
3849                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3850                 else
3851                         memset(wl->bssid, 0, ETH_ALEN);
3852         }
3853
3854         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3855                 if (changed & BSS_CHANGED_BEACON &&
3856                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3857                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3858                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3859                         b43_update_templates(wl);
3860
3861                 if (changed & BSS_CHANGED_BSSID)
3862                         b43_write_mac_bssid_templates(dev);
3863         }
3864
3865         b43_mac_suspend(dev);
3866
3867         /* Update templates for AP/mesh mode. */
3868         if (changed & BSS_CHANGED_BEACON_INT &&
3869             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3870              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3871              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3872                 b43_set_beacon_int(dev, conf->beacon_int);
3873
3874         if (changed & BSS_CHANGED_BASIC_RATES)
3875                 b43_update_basic_rates(dev, conf->basic_rates);
3876
3877         if (changed & BSS_CHANGED_ERP_SLOT) {
3878                 if (conf->use_short_slot)
3879                         b43_short_slot_timing_enable(dev);
3880                 else
3881                         b43_short_slot_timing_disable(dev);
3882         }
3883
3884         b43_mac_enable(dev);
3885 out_unlock_mutex:
3886         mutex_unlock(&wl->mutex);
3887 }
3888
3889 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3890                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3891                           struct ieee80211_key_conf *key)
3892 {
3893         struct b43_wl *wl = hw_to_b43_wl(hw);
3894         struct b43_wldev *dev;
3895         u8 algorithm;
3896         u8 index;
3897         int err;
3898         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3899
3900         if (modparam_nohwcrypt)
3901                 return -ENOSPC; /* User disabled HW-crypto */
3902
3903         mutex_lock(&wl->mutex);
3904
3905         dev = wl->current_dev;
3906         err = -ENODEV;
3907         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3908                 goto out_unlock;
3909
3910         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3911                 /* We don't have firmware for the crypto engine.
3912                  * Must use software-crypto. */
3913                 err = -EOPNOTSUPP;
3914                 goto out_unlock;
3915         }
3916
3917         err = -EINVAL;
3918         switch (key->cipher) {
3919         case WLAN_CIPHER_SUITE_WEP40:
3920                 algorithm = B43_SEC_ALGO_WEP40;
3921                 break;
3922         case WLAN_CIPHER_SUITE_WEP104:
3923                 algorithm = B43_SEC_ALGO_WEP104;
3924                 break;
3925         case WLAN_CIPHER_SUITE_TKIP:
3926                 algorithm = B43_SEC_ALGO_TKIP;
3927                 break;
3928         case WLAN_CIPHER_SUITE_CCMP:
3929                 algorithm = B43_SEC_ALGO_AES;
3930                 break;
3931         default:
3932                 B43_WARN_ON(1);
3933                 goto out_unlock;
3934         }
3935         index = (u8) (key->keyidx);
3936         if (index > 3)
3937                 goto out_unlock;
3938
3939         switch (cmd) {
3940         case SET_KEY:
3941                 if (algorithm == B43_SEC_ALGO_TKIP &&
3942                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3943                     !modparam_hwtkip)) {
3944                         /* We support only pairwise key */
3945                         err = -EOPNOTSUPP;
3946                         goto out_unlock;
3947                 }
3948
3949                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3950                         if (WARN_ON(!sta)) {
3951                                 err = -EOPNOTSUPP;
3952                                 goto out_unlock;
3953                         }
3954                         /* Pairwise key with an assigned MAC address. */
3955                         err = b43_key_write(dev, -1, algorithm,
3956                                             key->key, key->keylen,
3957                                             sta->addr, key);
3958                 } else {
3959                         /* Group key */
3960                         err = b43_key_write(dev, index, algorithm,
3961                                             key->key, key->keylen, NULL, key);
3962                 }
3963                 if (err)
3964                         goto out_unlock;
3965
3966                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3967                     algorithm == B43_SEC_ALGO_WEP104) {
3968                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3969                 } else {
3970                         b43_hf_write(dev,
3971                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3972                 }
3973                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3974                 if (algorithm == B43_SEC_ALGO_TKIP)
3975                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3976                 break;
3977         case DISABLE_KEY: {
3978                 err = b43_key_clear(dev, key->hw_key_idx);
3979                 if (err)
3980                         goto out_unlock;
3981                 break;
3982         }
3983         default:
3984                 B43_WARN_ON(1);
3985         }
3986
3987 out_unlock:
3988         if (!err) {
3989                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3990                        "mac: %pM\n",
3991                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3992                        sta ? sta->addr : bcast_addr);
3993                 b43_dump_keymemory(dev);
3994         }
3995         mutex_unlock(&wl->mutex);
3996
3997         return err;
3998 }
3999
4000 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4001                                     unsigned int changed, unsigned int *fflags,
4002                                     u64 multicast)
4003 {
4004         struct b43_wl *wl = hw_to_b43_wl(hw);
4005         struct b43_wldev *dev;
4006
4007         mutex_lock(&wl->mutex);
4008         dev = wl->current_dev;
4009         if (!dev) {
4010                 *fflags = 0;
4011                 goto out_unlock;
4012         }
4013
4014         *fflags &= FIF_PROMISC_IN_BSS |
4015                   FIF_ALLMULTI |
4016                   FIF_FCSFAIL |
4017                   FIF_PLCPFAIL |
4018                   FIF_CONTROL |
4019                   FIF_OTHER_BSS |
4020                   FIF_BCN_PRBRESP_PROMISC;
4021
4022         changed &= FIF_PROMISC_IN_BSS |
4023                    FIF_ALLMULTI |
4024                    FIF_FCSFAIL |
4025                    FIF_PLCPFAIL |
4026                    FIF_CONTROL |
4027                    FIF_OTHER_BSS |
4028                    FIF_BCN_PRBRESP_PROMISC;
4029
4030         wl->filter_flags = *fflags;
4031
4032         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4033                 b43_adjust_opmode(dev);
4034
4035 out_unlock:
4036         mutex_unlock(&wl->mutex);
4037 }
4038
4039 /* Locking: wl->mutex
4040  * Returns the current dev. This might be different from the passed in dev,
4041  * because the core might be gone away while we unlocked the mutex. */
4042 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4043 {
4044         struct b43_wl *wl = dev->wl;
4045         struct b43_wldev *orig_dev;
4046         u32 mask;
4047
4048 redo:
4049         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4050                 return dev;
4051
4052         /* Cancel work. Unlock to avoid deadlocks. */
4053         mutex_unlock(&wl->mutex);
4054         cancel_delayed_work_sync(&dev->periodic_work);
4055         cancel_work_sync(&wl->tx_work);
4056         mutex_lock(&wl->mutex);
4057         dev = wl->current_dev;
4058         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4059                 /* Whoops, aliens ate up the device while we were unlocked. */
4060                 return dev;
4061         }
4062
4063         /* Disable interrupts on the device. */
4064         b43_set_status(dev, B43_STAT_INITIALIZED);
4065         if (b43_bus_host_is_sdio(dev->dev)) {
4066                 /* wl->mutex is locked. That is enough. */
4067                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4068                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4069         } else {
4070                 spin_lock_irq(&wl->hardirq_lock);
4071                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4072                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4073                 spin_unlock_irq(&wl->hardirq_lock);
4074         }
4075         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4076         orig_dev = dev;
4077         mutex_unlock(&wl->mutex);
4078         if (b43_bus_host_is_sdio(dev->dev)) {
4079                 b43_sdio_free_irq(dev);
4080         } else {
4081                 synchronize_irq(dev->dev->irq);
4082                 free_irq(dev->dev->irq, dev);
4083         }
4084         mutex_lock(&wl->mutex);
4085         dev = wl->current_dev;
4086         if (!dev)
4087                 return dev;
4088         if (dev != orig_dev) {
4089                 if (b43_status(dev) >= B43_STAT_STARTED)
4090                         goto redo;
4091                 return dev;
4092         }
4093         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4094         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4095
4096         /* Drain the TX queue */
4097         while (skb_queue_len(&wl->tx_queue))
4098                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4099
4100         b43_mac_suspend(dev);
4101         b43_leds_exit(dev);
4102         b43dbg(wl, "Wireless interface stopped\n");
4103
4104         return dev;
4105 }
4106
4107 /* Locking: wl->mutex */
4108 static int b43_wireless_core_start(struct b43_wldev *dev)
4109 {
4110         int err;
4111
4112         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4113
4114         drain_txstatus_queue(dev);
4115         if (b43_bus_host_is_sdio(dev->dev)) {
4116                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4117                 if (err) {
4118                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4119                         goto out;
4120                 }
4121         } else {
4122                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4123                                            b43_interrupt_thread_handler,
4124                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4125                 if (err) {
4126                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4127                                dev->dev->irq);
4128                         goto out;
4129                 }
4130         }
4131
4132         /* We are ready to run. */
4133         ieee80211_wake_queues(dev->wl->hw);
4134         b43_set_status(dev, B43_STAT_STARTED);
4135
4136         /* Start data flow (TX/RX). */
4137         b43_mac_enable(dev);
4138         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4139
4140         /* Start maintenance work */
4141         b43_periodic_tasks_setup(dev);
4142
4143         b43_leds_init(dev);
4144
4145         b43dbg(dev->wl, "Wireless interface started\n");
4146 out:
4147         return err;
4148 }
4149
4150 /* Get PHY and RADIO versioning numbers */
4151 static int b43_phy_versioning(struct b43_wldev *dev)
4152 {
4153         struct b43_phy *phy = &dev->phy;
4154         u32 tmp;
4155         u8 analog_type;
4156         u8 phy_type;
4157         u8 phy_rev;
4158         u16 radio_manuf;
4159         u16 radio_ver;
4160         u16 radio_rev;
4161         int unsupported = 0;
4162
4163         /* Get PHY versioning */
4164         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4165         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4166         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4167         phy_rev = (tmp & B43_PHYVER_VERSION);
4168         switch (phy_type) {
4169         case B43_PHYTYPE_A:
4170                 if (phy_rev >= 4)
4171                         unsupported = 1;
4172                 break;
4173         case B43_PHYTYPE_B:
4174                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4175                     && phy_rev != 7)
4176                         unsupported = 1;
4177                 break;
4178         case B43_PHYTYPE_G:
4179                 if (phy_rev > 9)
4180                         unsupported = 1;
4181                 break;
4182 #ifdef CONFIG_B43_PHY_N
4183         case B43_PHYTYPE_N:
4184                 if (phy_rev > 9)
4185                         unsupported = 1;
4186                 break;
4187 #endif
4188 #ifdef CONFIG_B43_PHY_LP
4189         case B43_PHYTYPE_LP:
4190                 if (phy_rev > 2)
4191                         unsupported = 1;
4192                 break;
4193 #endif
4194 #ifdef CONFIG_B43_PHY_HT
4195         case B43_PHYTYPE_HT:
4196                 if (phy_rev > 1)
4197                         unsupported = 1;
4198                 break;
4199 #endif
4200         default:
4201                 unsupported = 1;
4202         };
4203         if (unsupported) {
4204                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4205                        "(Analog %u, Type %u, Revision %u)\n",
4206                        analog_type, phy_type, phy_rev);
4207                 return -EOPNOTSUPP;
4208         }
4209         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4210                analog_type, phy_type, phy_rev);
4211
4212         /* Get RADIO versioning */
4213         if (dev->dev->chip_id == 0x4317) {
4214                 if (dev->dev->chip_rev == 0)
4215                         tmp = 0x3205017F;
4216                 else if (dev->dev->chip_rev == 1)
4217                         tmp = 0x4205017F;
4218                 else
4219                         tmp = 0x5205017F;
4220         } else {
4221                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4222                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4223                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4224                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4225         }
4226         radio_manuf = (tmp & 0x00000FFF);
4227         radio_ver = (tmp & 0x0FFFF000) >> 12;
4228         radio_rev = (tmp & 0xF0000000) >> 28;
4229         if (radio_manuf != 0x17F /* Broadcom */)
4230                 unsupported = 1;
4231         switch (phy_type) {
4232         case B43_PHYTYPE_A:
4233                 if (radio_ver != 0x2060)
4234                         unsupported = 1;
4235                 if (radio_rev != 1)
4236                         unsupported = 1;
4237                 if (radio_manuf != 0x17F)
4238                         unsupported = 1;
4239                 break;
4240         case B43_PHYTYPE_B:
4241                 if ((radio_ver & 0xFFF0) != 0x2050)
4242                         unsupported = 1;
4243                 break;
4244         case B43_PHYTYPE_G:
4245                 if (radio_ver != 0x2050)
4246                         unsupported = 1;
4247                 break;
4248         case B43_PHYTYPE_N:
4249                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4250                         unsupported = 1;
4251                 break;
4252         case B43_PHYTYPE_LP:
4253                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4254                         unsupported = 1;
4255                 break;
4256         case B43_PHYTYPE_HT:
4257                 if (radio_ver != 0x2059)
4258                         unsupported = 1;
4259                 break;
4260         default:
4261                 B43_WARN_ON(1);
4262         }
4263         if (unsupported) {
4264                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4265                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4266                        radio_manuf, radio_ver, radio_rev);
4267                 return -EOPNOTSUPP;
4268         }
4269         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4270                radio_manuf, radio_ver, radio_rev);
4271
4272         phy->radio_manuf = radio_manuf;
4273         phy->radio_ver = radio_ver;
4274         phy->radio_rev = radio_rev;
4275
4276         phy->analog = analog_type;
4277         phy->type = phy_type;
4278         phy->rev = phy_rev;
4279
4280         return 0;
4281 }
4282
4283 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4284                                       struct b43_phy *phy)
4285 {
4286         phy->hardware_power_control = !!modparam_hwpctl;
4287         phy->next_txpwr_check_time = jiffies;
4288         /* PHY TX errors counter. */
4289         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4290
4291 #if B43_DEBUG
4292         phy->phy_locked = 0;
4293         phy->radio_locked = 0;
4294 #endif
4295 }
4296
4297 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4298 {
4299         dev->dfq_valid = 0;
4300
4301         /* Assume the radio is enabled. If it's not enabled, the state will
4302          * immediately get fixed on the first periodic work run. */
4303         dev->radio_hw_enable = 1;
4304
4305         /* Stats */
4306         memset(&dev->stats, 0, sizeof(dev->stats));
4307
4308         setup_struct_phy_for_init(dev, &dev->phy);
4309
4310         /* IRQ related flags */
4311         dev->irq_reason = 0;
4312         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4313         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4314         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4315                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4316
4317         dev->mac_suspended = 1;
4318
4319         /* Noise calculation context */
4320         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4321 }
4322
4323 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4324 {
4325         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4326         u64 hf;
4327
4328         if (!modparam_btcoex)
4329                 return;
4330         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4331                 return;
4332         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4333                 return;
4334
4335         hf = b43_hf_read(dev);
4336         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4337                 hf |= B43_HF_BTCOEXALT;
4338         else
4339                 hf |= B43_HF_BTCOEX;
4340         b43_hf_write(dev, hf);
4341 }
4342
4343 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4344 {
4345         if (!modparam_btcoex)
4346                 return;
4347         //TODO
4348 }
4349
4350 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4351 {
4352         struct ssb_bus *bus;
4353         u32 tmp;
4354
4355         if (dev->dev->bus_type != B43_BUS_SSB)
4356                 return;
4357
4358         bus = dev->dev->sdev->bus;
4359
4360         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4361             (bus->chip_id == 0x4312)) {
4362                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4363                 tmp &= ~SSB_IMCFGLO_REQTO;
4364                 tmp &= ~SSB_IMCFGLO_SERTO;
4365                 tmp |= 0x3;
4366                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4367                 ssb_commit_settings(bus);
4368         }
4369 }
4370
4371 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4372 {
4373         u16 pu_delay;
4374
4375         /* The time value is in microseconds. */
4376         if (dev->phy.type == B43_PHYTYPE_A)
4377                 pu_delay = 3700;
4378         else
4379                 pu_delay = 1050;
4380         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4381                 pu_delay = 500;
4382         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4383                 pu_delay = max(pu_delay, (u16)2400);
4384
4385         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4386 }
4387
4388 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4389 static void b43_set_pretbtt(struct b43_wldev *dev)
4390 {
4391         u16 pretbtt;
4392
4393         /* The time value is in microseconds. */
4394         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4395                 pretbtt = 2;
4396         } else {
4397                 if (dev->phy.type == B43_PHYTYPE_A)
4398                         pretbtt = 120;
4399                 else
4400                         pretbtt = 250;
4401         }
4402         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4403         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4404 }
4405
4406 /* Shutdown a wireless core */
4407 /* Locking: wl->mutex */
4408 static void b43_wireless_core_exit(struct b43_wldev *dev)
4409 {
4410         u32 macctl;
4411
4412         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4413         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4414                 return;
4415
4416         /* Unregister HW RNG driver */
4417         b43_rng_exit(dev->wl);
4418
4419         b43_set_status(dev, B43_STAT_UNINIT);
4420
4421         /* Stop the microcode PSM. */
4422         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4423         macctl &= ~B43_MACCTL_PSM_RUN;
4424         macctl |= B43_MACCTL_PSM_JMP0;
4425         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4426
4427         b43_dma_free(dev);
4428         b43_pio_free(dev);
4429         b43_chip_exit(dev);
4430         dev->phy.ops->switch_analog(dev, 0);
4431         if (dev->wl->current_beacon) {
4432                 dev_kfree_skb_any(dev->wl->current_beacon);
4433                 dev->wl->current_beacon = NULL;
4434         }
4435
4436         b43_device_disable(dev, 0);
4437         b43_bus_may_powerdown(dev);
4438 }
4439
4440 /* Initialize a wireless core */
4441 static int b43_wireless_core_init(struct b43_wldev *dev)
4442 {
4443         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4444         struct b43_phy *phy = &dev->phy;
4445         int err;
4446         u64 hf;
4447
4448         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4449
4450         err = b43_bus_powerup(dev, 0);
4451         if (err)
4452                 goto out;
4453         if (!b43_device_is_enabled(dev))
4454                 b43_wireless_core_reset(dev, phy->gmode);
4455
4456         /* Reset all data structures. */
4457         setup_struct_wldev_for_init(dev);
4458         phy->ops->prepare_structs(dev);
4459
4460         /* Enable IRQ routing to this device. */
4461         switch (dev->dev->bus_type) {
4462 #ifdef CONFIG_B43_BCMA
4463         case B43_BUS_BCMA:
4464                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4465                                       dev->dev->bdev, true);
4466                 break;
4467 #endif
4468 #ifdef CONFIG_B43_SSB
4469         case B43_BUS_SSB:
4470                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4471                                                dev->dev->sdev);
4472                 break;
4473 #endif
4474         }
4475
4476         b43_imcfglo_timeouts_workaround(dev);
4477         b43_bluetooth_coext_disable(dev);
4478         if (phy->ops->prepare_hardware) {
4479                 err = phy->ops->prepare_hardware(dev);
4480                 if (err)
4481                         goto err_busdown;
4482         }
4483         err = b43_chip_init(dev);
4484         if (err)
4485                 goto err_busdown;
4486         b43_shm_write16(dev, B43_SHM_SHARED,
4487                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4488         hf = b43_hf_read(dev);
4489         if (phy->type == B43_PHYTYPE_G) {
4490                 hf |= B43_HF_SYMW;
4491                 if (phy->rev == 1)
4492                         hf |= B43_HF_GDCW;
4493                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4494                         hf |= B43_HF_OFDMPABOOST;
4495         }
4496         if (phy->radio_ver == 0x2050) {
4497                 if (phy->radio_rev == 6)
4498                         hf |= B43_HF_4318TSSI;
4499                 if (phy->radio_rev < 6)
4500                         hf |= B43_HF_VCORECALC;
4501         }
4502         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4503                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4504 #ifdef CONFIG_SSB_DRIVER_PCICORE
4505         if (dev->dev->bus_type == B43_BUS_SSB &&
4506             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4507             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4508                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4509 #endif
4510         hf &= ~B43_HF_SKCFPUP;
4511         b43_hf_write(dev, hf);
4512
4513         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4514                              B43_DEFAULT_LONG_RETRY_LIMIT);
4515         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4516         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4517
4518         /* Disable sending probe responses from firmware.
4519          * Setting the MaxTime to one usec will always trigger
4520          * a timeout, so we never send any probe resp.
4521          * A timeout of zero is infinite. */
4522         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4523
4524         b43_rate_memory_init(dev);
4525         b43_set_phytxctl_defaults(dev);
4526
4527         /* Minimum Contention Window */
4528         if (phy->type == B43_PHYTYPE_B)
4529                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4530         else
4531                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4532         /* Maximum Contention Window */
4533         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4534
4535         if (b43_bus_host_is_pcmcia(dev->dev) ||
4536             b43_bus_host_is_sdio(dev->dev) ||
4537             dev->use_pio) {
4538                 dev->__using_pio_transfers = 1;
4539                 err = b43_pio_init(dev);
4540         } else {
4541                 dev->__using_pio_transfers = 0;
4542                 err = b43_dma_init(dev);
4543         }
4544         if (err)
4545                 goto err_chip_exit;
4546         b43_qos_init(dev);
4547         b43_set_synth_pu_delay(dev, 1);
4548         b43_bluetooth_coext_enable(dev);
4549
4550         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4551         b43_upload_card_macaddress(dev);
4552         b43_security_init(dev);
4553
4554         ieee80211_wake_queues(dev->wl->hw);
4555
4556         b43_set_status(dev, B43_STAT_INITIALIZED);
4557
4558         /* Register HW RNG driver */
4559         b43_rng_init(dev->wl);
4560
4561 out:
4562         return err;
4563
4564 err_chip_exit:
4565         b43_chip_exit(dev);
4566 err_busdown:
4567         b43_bus_may_powerdown(dev);
4568         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4569         return err;
4570 }
4571
4572 static int b43_op_add_interface(struct ieee80211_hw *hw,
4573                                 struct ieee80211_vif *vif)
4574 {
4575         struct b43_wl *wl = hw_to_b43_wl(hw);
4576         struct b43_wldev *dev;
4577         int err = -EOPNOTSUPP;
4578
4579         /* TODO: allow WDS/AP devices to coexist */
4580
4581         if (vif->type != NL80211_IFTYPE_AP &&
4582             vif->type != NL80211_IFTYPE_MESH_POINT &&
4583             vif->type != NL80211_IFTYPE_STATION &&
4584             vif->type != NL80211_IFTYPE_WDS &&
4585             vif->type != NL80211_IFTYPE_ADHOC)
4586                 return -EOPNOTSUPP;
4587
4588         mutex_lock(&wl->mutex);
4589         if (wl->operating)
4590                 goto out_mutex_unlock;
4591
4592         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4593
4594         dev = wl->current_dev;
4595         wl->operating = 1;
4596         wl->vif = vif;
4597         wl->if_type = vif->type;
4598         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4599
4600         b43_adjust_opmode(dev);
4601         b43_set_pretbtt(dev);
4602         b43_set_synth_pu_delay(dev, 0);
4603         b43_upload_card_macaddress(dev);
4604
4605         err = 0;
4606  out_mutex_unlock:
4607         mutex_unlock(&wl->mutex);
4608
4609         return err;
4610 }
4611
4612 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4613                                     struct ieee80211_vif *vif)
4614 {
4615         struct b43_wl *wl = hw_to_b43_wl(hw);
4616         struct b43_wldev *dev = wl->current_dev;
4617
4618         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4619
4620         mutex_lock(&wl->mutex);
4621
4622         B43_WARN_ON(!wl->operating);
4623         B43_WARN_ON(wl->vif != vif);
4624         wl->vif = NULL;
4625
4626         wl->operating = 0;
4627
4628         b43_adjust_opmode(dev);
4629         memset(wl->mac_addr, 0, ETH_ALEN);
4630         b43_upload_card_macaddress(dev);
4631
4632         mutex_unlock(&wl->mutex);
4633 }
4634
4635 static int b43_op_start(struct ieee80211_hw *hw)
4636 {
4637         struct b43_wl *wl = hw_to_b43_wl(hw);
4638         struct b43_wldev *dev = wl->current_dev;
4639         int did_init = 0;
4640         int err = 0;
4641
4642         /* Kill all old instance specific information to make sure
4643          * the card won't use it in the short timeframe between start
4644          * and mac80211 reconfiguring it. */
4645         memset(wl->bssid, 0, ETH_ALEN);
4646         memset(wl->mac_addr, 0, ETH_ALEN);
4647         wl->filter_flags = 0;
4648         wl->radiotap_enabled = 0;
4649         b43_qos_clear(wl);
4650         wl->beacon0_uploaded = 0;
4651         wl->beacon1_uploaded = 0;
4652         wl->beacon_templates_virgin = 1;
4653         wl->radio_enabled = 1;
4654
4655         mutex_lock(&wl->mutex);
4656
4657         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4658                 err = b43_wireless_core_init(dev);
4659                 if (err)
4660                         goto out_mutex_unlock;
4661                 did_init = 1;
4662         }
4663
4664         if (b43_status(dev) < B43_STAT_STARTED) {
4665                 err = b43_wireless_core_start(dev);
4666                 if (err) {
4667                         if (did_init)
4668                                 b43_wireless_core_exit(dev);
4669                         goto out_mutex_unlock;
4670                 }
4671         }
4672
4673         /* XXX: only do if device doesn't support rfkill irq */
4674         wiphy_rfkill_start_polling(hw->wiphy);
4675
4676  out_mutex_unlock:
4677         mutex_unlock(&wl->mutex);
4678
4679         return err;
4680 }
4681
4682 static void b43_op_stop(struct ieee80211_hw *hw)
4683 {
4684         struct b43_wl *wl = hw_to_b43_wl(hw);
4685         struct b43_wldev *dev = wl->current_dev;
4686
4687         cancel_work_sync(&(wl->beacon_update_trigger));
4688
4689         mutex_lock(&wl->mutex);
4690         if (b43_status(dev) >= B43_STAT_STARTED) {
4691                 dev = b43_wireless_core_stop(dev);
4692                 if (!dev)
4693                         goto out_unlock;
4694         }
4695         b43_wireless_core_exit(dev);
4696         wl->radio_enabled = 0;
4697
4698 out_unlock:
4699         mutex_unlock(&wl->mutex);
4700
4701         cancel_work_sync(&(wl->txpower_adjust_work));
4702 }
4703
4704 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4705                                  struct ieee80211_sta *sta, bool set)
4706 {
4707         struct b43_wl *wl = hw_to_b43_wl(hw);
4708
4709         /* FIXME: add locking */
4710         b43_update_templates(wl);
4711
4712         return 0;
4713 }
4714
4715 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4716                               struct ieee80211_vif *vif,
4717                               enum sta_notify_cmd notify_cmd,
4718                               struct ieee80211_sta *sta)
4719 {
4720         struct b43_wl *wl = hw_to_b43_wl(hw);
4721
4722         B43_WARN_ON(!vif || wl->vif != vif);
4723 }
4724
4725 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4726 {
4727         struct b43_wl *wl = hw_to_b43_wl(hw);
4728         struct b43_wldev *dev;
4729
4730         mutex_lock(&wl->mutex);
4731         dev = wl->current_dev;
4732         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4733                 /* Disable CFP update during scan on other channels. */
4734                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4735         }
4736         mutex_unlock(&wl->mutex);
4737 }
4738
4739 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4740 {
4741         struct b43_wl *wl = hw_to_b43_wl(hw);
4742         struct b43_wldev *dev;
4743
4744         mutex_lock(&wl->mutex);
4745         dev = wl->current_dev;
4746         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4747                 /* Re-enable CFP update. */
4748                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4749         }
4750         mutex_unlock(&wl->mutex);
4751 }
4752
4753 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4754                              struct survey_info *survey)
4755 {
4756         struct b43_wl *wl = hw_to_b43_wl(hw);
4757         struct b43_wldev *dev = wl->current_dev;
4758         struct ieee80211_conf *conf = &hw->conf;
4759
4760         if (idx != 0)
4761                 return -ENOENT;
4762
4763         survey->channel = conf->channel;
4764         survey->filled = SURVEY_INFO_NOISE_DBM;
4765         survey->noise = dev->stats.link_noise;
4766
4767         return 0;
4768 }
4769
4770 static const struct ieee80211_ops b43_hw_ops = {
4771         .tx                     = b43_op_tx,
4772         .conf_tx                = b43_op_conf_tx,
4773         .add_interface          = b43_op_add_interface,
4774         .remove_interface       = b43_op_remove_interface,
4775         .config                 = b43_op_config,
4776         .bss_info_changed       = b43_op_bss_info_changed,
4777         .configure_filter       = b43_op_configure_filter,
4778         .set_key                = b43_op_set_key,
4779         .update_tkip_key        = b43_op_update_tkip_key,
4780         .get_stats              = b43_op_get_stats,
4781         .get_tsf                = b43_op_get_tsf,
4782         .set_tsf                = b43_op_set_tsf,
4783         .start                  = b43_op_start,
4784         .stop                   = b43_op_stop,
4785         .set_tim                = b43_op_beacon_set_tim,
4786         .sta_notify             = b43_op_sta_notify,
4787         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4788         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4789         .get_survey             = b43_op_get_survey,
4790         .rfkill_poll            = b43_rfkill_poll,
4791 };
4792
4793 /* Hard-reset the chip. Do not call this directly.
4794  * Use b43_controller_restart()
4795  */
4796 static void b43_chip_reset(struct work_struct *work)
4797 {
4798         struct b43_wldev *dev =
4799             container_of(work, struct b43_wldev, restart_work);
4800         struct b43_wl *wl = dev->wl;
4801         int err = 0;
4802         int prev_status;
4803
4804         mutex_lock(&wl->mutex);
4805
4806         prev_status = b43_status(dev);
4807         /* Bring the device down... */
4808         if (prev_status >= B43_STAT_STARTED) {
4809                 dev = b43_wireless_core_stop(dev);
4810                 if (!dev) {
4811                         err = -ENODEV;
4812                         goto out;
4813                 }
4814         }
4815         if (prev_status >= B43_STAT_INITIALIZED)
4816                 b43_wireless_core_exit(dev);
4817
4818         /* ...and up again. */
4819         if (prev_status >= B43_STAT_INITIALIZED) {
4820                 err = b43_wireless_core_init(dev);
4821                 if (err)
4822                         goto out;
4823         }
4824         if (prev_status >= B43_STAT_STARTED) {
4825                 err = b43_wireless_core_start(dev);
4826                 if (err) {
4827                         b43_wireless_core_exit(dev);
4828                         goto out;
4829                 }
4830         }
4831 out:
4832         if (err)
4833                 wl->current_dev = NULL; /* Failed to init the dev. */
4834         mutex_unlock(&wl->mutex);
4835         if (err)
4836                 b43err(wl, "Controller restart FAILED\n");
4837         else
4838                 b43info(wl, "Controller restarted\n");
4839 }
4840
4841 static int b43_setup_bands(struct b43_wldev *dev,
4842                            bool have_2ghz_phy, bool have_5ghz_phy)
4843 {
4844         struct ieee80211_hw *hw = dev->wl->hw;
4845
4846         if (have_2ghz_phy)
4847                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4848         if (dev->phy.type == B43_PHYTYPE_N) {
4849                 if (have_5ghz_phy)
4850                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4851         } else {
4852                 if (have_5ghz_phy)
4853                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4854         }
4855
4856         dev->phy.supports_2ghz = have_2ghz_phy;
4857         dev->phy.supports_5ghz = have_5ghz_phy;
4858
4859         return 0;
4860 }
4861
4862 static void b43_wireless_core_detach(struct b43_wldev *dev)
4863 {
4864         /* We release firmware that late to not be required to re-request
4865          * is all the time when we reinit the core. */
4866         b43_release_firmware(dev);
4867         b43_phy_free(dev);
4868 }
4869
4870 static int b43_wireless_core_attach(struct b43_wldev *dev)
4871 {
4872         struct b43_wl *wl = dev->wl;
4873         struct pci_dev *pdev = NULL;
4874         int err;
4875         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4876
4877         /* Do NOT do any device initialization here.
4878          * Do it in wireless_core_init() instead.
4879          * This function is for gathering basic information about the HW, only.
4880          * Also some structs may be set up here. But most likely you want to have
4881          * that in core_init(), too.
4882          */
4883
4884 #ifdef CONFIG_B43_SSB
4885         if (dev->dev->bus_type == B43_BUS_SSB &&
4886             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4887                 pdev = dev->dev->sdev->bus->host_pci;
4888 #endif
4889
4890         err = b43_bus_powerup(dev, 0);
4891         if (err) {
4892                 b43err(wl, "Bus powerup failed\n");
4893                 goto out;
4894         }
4895
4896         /* Get the PHY type. */
4897         switch (dev->dev->bus_type) {
4898 #ifdef CONFIG_B43_BCMA
4899         case B43_BUS_BCMA:
4900                 /* FIXME */
4901                 have_2ghz_phy = 1;
4902                 have_5ghz_phy = 0;
4903                 break;
4904 #endif
4905 #ifdef CONFIG_B43_SSB
4906         case B43_BUS_SSB:
4907                 if (dev->dev->core_rev >= 5) {
4908                         u32 tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
4909                         have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4910                         have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4911                 } else
4912                         B43_WARN_ON(1);
4913                 break;
4914 #endif
4915         }
4916
4917         dev->phy.gmode = have_2ghz_phy;
4918         dev->phy.radio_on = 1;
4919         b43_wireless_core_reset(dev, dev->phy.gmode);
4920
4921         err = b43_phy_versioning(dev);
4922         if (err)
4923                 goto err_powerdown;
4924         /* Check if this device supports multiband. */
4925         if (!pdev ||
4926             (pdev->device != 0x4312 &&
4927              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4928                 /* No multiband support. */
4929                 have_2ghz_phy = 0;
4930                 have_5ghz_phy = 0;
4931                 switch (dev->phy.type) {
4932                 case B43_PHYTYPE_A:
4933                         have_5ghz_phy = 1;
4934                         break;
4935                 case B43_PHYTYPE_LP: //FIXME not always!
4936 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4937                         have_5ghz_phy = 1;
4938 #endif
4939                 case B43_PHYTYPE_G:
4940                 case B43_PHYTYPE_N:
4941                         have_2ghz_phy = 1;
4942                         break;
4943                 default:
4944                         B43_WARN_ON(1);
4945                 }
4946         }
4947         if (dev->phy.type == B43_PHYTYPE_A) {
4948                 /* FIXME */
4949                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4950                 err = -EOPNOTSUPP;
4951                 goto err_powerdown;
4952         }
4953         if (1 /* disable A-PHY */) {
4954                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4955                 if (dev->phy.type != B43_PHYTYPE_N &&
4956                     dev->phy.type != B43_PHYTYPE_LP) {
4957                         have_2ghz_phy = 1;
4958                         have_5ghz_phy = 0;
4959                 }
4960         }
4961
4962         err = b43_phy_allocate(dev);
4963         if (err)
4964                 goto err_powerdown;
4965
4966         dev->phy.gmode = have_2ghz_phy;
4967         b43_wireless_core_reset(dev, dev->phy.gmode);
4968
4969         err = b43_validate_chipaccess(dev);
4970         if (err)
4971                 goto err_phy_free;
4972         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4973         if (err)
4974                 goto err_phy_free;
4975
4976         /* Now set some default "current_dev" */
4977         if (!wl->current_dev)
4978                 wl->current_dev = dev;
4979         INIT_WORK(&dev->restart_work, b43_chip_reset);
4980
4981         dev->phy.ops->switch_analog(dev, 0);
4982         b43_device_disable(dev, 0);
4983         b43_bus_may_powerdown(dev);
4984
4985 out:
4986         return err;
4987
4988 err_phy_free:
4989         b43_phy_free(dev);
4990 err_powerdown:
4991         b43_bus_may_powerdown(dev);
4992         return err;
4993 }
4994
4995 static void b43_one_core_detach(struct b43_bus_dev *dev)
4996 {
4997         struct b43_wldev *wldev;
4998         struct b43_wl *wl;
4999
5000         /* Do not cancel ieee80211-workqueue based work here.
5001          * See comment in b43_remove(). */
5002
5003         wldev = ssb_get_drvdata(dev->sdev);
5004         wl = wldev->wl;
5005         b43_debugfs_remove_device(wldev);
5006         b43_wireless_core_detach(wldev);
5007         list_del(&wldev->list);
5008         wl->nr_devs--;
5009         ssb_set_drvdata(dev->sdev, NULL);
5010         kfree(wldev);
5011 }
5012
5013 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5014 {
5015         struct b43_wldev *wldev;
5016         int err = -ENOMEM;
5017
5018         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5019         if (!wldev)
5020                 goto out;
5021
5022         wldev->use_pio = b43_modparam_pio;
5023         wldev->dev = dev;
5024         wldev->wl = wl;
5025         b43_set_status(wldev, B43_STAT_UNINIT);
5026         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5027         INIT_LIST_HEAD(&wldev->list);
5028
5029         err = b43_wireless_core_attach(wldev);
5030         if (err)
5031                 goto err_kfree_wldev;
5032
5033         list_add(&wldev->list, &wl->devlist);
5034         wl->nr_devs++;
5035         ssb_set_drvdata(dev->sdev, wldev);
5036         b43_debugfs_add_device(wldev);
5037
5038       out:
5039         return err;
5040
5041       err_kfree_wldev:
5042         kfree(wldev);
5043         return err;
5044 }
5045
5046 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5047         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5048         (pdev->device == _device) &&                                    \
5049         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5050         (pdev->subsystem_device == _subdevice)                          )
5051
5052 static void b43_sprom_fixup(struct ssb_bus *bus)
5053 {
5054         struct pci_dev *pdev;
5055
5056         /* boardflags workarounds */
5057         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5058             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5059                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5060         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5061             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5062                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5063         if (bus->bustype == SSB_BUSTYPE_PCI) {
5064                 pdev = bus->host_pci;
5065                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5066                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5067                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5068                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5069                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5070                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5071                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5072                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5073         }
5074 }
5075
5076 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5077 {
5078         struct ieee80211_hw *hw = wl->hw;
5079
5080         ssb_set_devtypedata(dev->sdev, NULL);
5081         ieee80211_free_hw(hw);
5082 }
5083
5084 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5085 {
5086         struct ssb_sprom *sprom = dev->bus_sprom;
5087         struct ieee80211_hw *hw;
5088         struct b43_wl *wl;
5089
5090         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5091         if (!hw) {
5092                 b43err(NULL, "Could not allocate ieee80211 device\n");
5093                 return ERR_PTR(-ENOMEM);
5094         }
5095         wl = hw_to_b43_wl(hw);
5096
5097         /* fill hw info */
5098         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5099                     IEEE80211_HW_SIGNAL_DBM;
5100
5101         hw->wiphy->interface_modes =
5102                 BIT(NL80211_IFTYPE_AP) |
5103                 BIT(NL80211_IFTYPE_MESH_POINT) |
5104                 BIT(NL80211_IFTYPE_STATION) |
5105                 BIT(NL80211_IFTYPE_WDS) |
5106                 BIT(NL80211_IFTYPE_ADHOC);
5107
5108         hw->queues = modparam_qos ? 4 : 1;
5109         wl->mac80211_initially_registered_queues = hw->queues;
5110         hw->max_rates = 2;
5111         SET_IEEE80211_DEV(hw, dev->dev);
5112         if (is_valid_ether_addr(sprom->et1mac))
5113                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5114         else
5115                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5116
5117         /* Initialize struct b43_wl */
5118         wl->hw = hw;
5119         mutex_init(&wl->mutex);
5120         spin_lock_init(&wl->hardirq_lock);
5121         INIT_LIST_HEAD(&wl->devlist);
5122         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5123         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5124         INIT_WORK(&wl->tx_work, b43_tx_work);
5125         skb_queue_head_init(&wl->tx_queue);
5126
5127         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5128                 dev->chip_id, dev->core_rev);
5129         return wl;
5130 }
5131
5132 #ifdef CONFIG_B43_BCMA
5133 static int b43_bcma_probe(struct bcma_device *core)
5134 {
5135         struct b43_bus_dev *dev;
5136
5137         dev = b43_bus_dev_bcma_init(core);
5138         if (!dev)
5139                 return -ENODEV;
5140
5141         b43err(NULL, "BCMA is not supported yet!");
5142         kfree(dev);
5143         return -EOPNOTSUPP;
5144 }
5145
5146 static void b43_bcma_remove(struct bcma_device *core)
5147 {
5148         /* TODO */
5149 }
5150
5151 static struct bcma_driver b43_bcma_driver = {
5152         .name           = KBUILD_MODNAME,
5153         .id_table       = b43_bcma_tbl,
5154         .probe          = b43_bcma_probe,
5155         .remove         = b43_bcma_remove,
5156 };
5157 #endif
5158
5159 #ifdef CONFIG_B43_SSB
5160 static
5161 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5162 {
5163         struct b43_bus_dev *dev;
5164         struct b43_wl *wl;
5165         int err;
5166         int first = 0;
5167
5168         dev = b43_bus_dev_ssb_init(sdev);
5169         if (!dev)
5170                 return -ENOMEM;
5171
5172         wl = ssb_get_devtypedata(sdev);
5173         if (!wl) {
5174                 /* Probing the first core. Must setup common struct b43_wl */
5175                 first = 1;
5176                 b43_sprom_fixup(sdev->bus);
5177                 wl = b43_wireless_init(dev);
5178                 if (IS_ERR(wl)) {
5179                         err = PTR_ERR(wl);
5180                         goto out;
5181                 }
5182                 ssb_set_devtypedata(sdev, wl);
5183                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5184         }
5185         err = b43_one_core_attach(dev, wl);
5186         if (err)
5187                 goto err_wireless_exit;
5188
5189         if (first) {
5190                 err = ieee80211_register_hw(wl->hw);
5191                 if (err)
5192                         goto err_one_core_detach;
5193                 b43_leds_register(wl->current_dev);
5194         }
5195
5196       out:
5197         return err;
5198
5199       err_one_core_detach:
5200         b43_one_core_detach(dev);
5201       err_wireless_exit:
5202         if (first)
5203                 b43_wireless_exit(dev, wl);
5204         return err;
5205 }
5206
5207 static void b43_ssb_remove(struct ssb_device *sdev)
5208 {
5209         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5210         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5211
5212         /* We must cancel any work here before unregistering from ieee80211,
5213          * as the ieee80211 unreg will destroy the workqueue. */
5214         cancel_work_sync(&wldev->restart_work);
5215
5216         B43_WARN_ON(!wl);
5217         if (wl->current_dev == wldev) {
5218                 /* Restore the queues count before unregistering, because firmware detect
5219                  * might have modified it. Restoring is important, so the networking
5220                  * stack can properly free resources. */
5221                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5222                 b43_leds_stop(wldev);
5223                 ieee80211_unregister_hw(wl->hw);
5224         }
5225
5226         b43_one_core_detach(wldev->dev);
5227
5228         if (list_empty(&wl->devlist)) {
5229                 b43_leds_unregister(wl);
5230                 /* Last core on the chip unregistered.
5231                  * We can destroy common struct b43_wl.
5232                  */
5233                 b43_wireless_exit(wldev->dev, wl);
5234         }
5235 }
5236
5237 static struct ssb_driver b43_ssb_driver = {
5238         .name           = KBUILD_MODNAME,
5239         .id_table       = b43_ssb_tbl,
5240         .probe          = b43_ssb_probe,
5241         .remove         = b43_ssb_remove,
5242 };
5243 #endif /* CONFIG_B43_SSB */
5244
5245 /* Perform a hardware reset. This can be called from any context. */
5246 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5247 {
5248         /* Must avoid requeueing, if we are in shutdown. */
5249         if (b43_status(dev) < B43_STAT_INITIALIZED)
5250                 return;
5251         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5252         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5253 }
5254
5255 static void b43_print_driverinfo(void)
5256 {
5257         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5258                    *feat_leds = "", *feat_sdio = "";
5259
5260 #ifdef CONFIG_B43_PCI_AUTOSELECT
5261         feat_pci = "P";
5262 #endif
5263 #ifdef CONFIG_B43_PCMCIA
5264         feat_pcmcia = "M";
5265 #endif
5266 #ifdef CONFIG_B43_PHY_N
5267         feat_nphy = "N";
5268 #endif
5269 #ifdef CONFIG_B43_LEDS
5270         feat_leds = "L";
5271 #endif
5272 #ifdef CONFIG_B43_SDIO
5273         feat_sdio = "S";
5274 #endif
5275         printk(KERN_INFO "Broadcom 43xx driver loaded "
5276                "[ Features: %s%s%s%s%s, Firmware-ID: "
5277                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5278                feat_pci, feat_pcmcia, feat_nphy,
5279                feat_leds, feat_sdio);
5280 }
5281
5282 static int __init b43_init(void)
5283 {
5284         int err;
5285
5286         b43_debugfs_init();
5287         err = b43_pcmcia_init();
5288         if (err)
5289                 goto err_dfs_exit;
5290         err = b43_sdio_init();
5291         if (err)
5292                 goto err_pcmcia_exit;
5293 #ifdef CONFIG_B43_BCMA
5294         err = bcma_driver_register(&b43_bcma_driver);
5295         if (err)
5296                 goto err_sdio_exit;
5297 #endif
5298 #ifdef CONFIG_B43_SSB
5299         err = ssb_driver_register(&b43_ssb_driver);
5300         if (err)
5301                 goto err_bcma_driver_exit;
5302 #endif
5303         b43_print_driverinfo();
5304
5305         return err;
5306
5307 #ifdef CONFIG_B43_SSB
5308 err_bcma_driver_exit:
5309 #endif
5310 #ifdef CONFIG_B43_BCMA
5311         bcma_driver_unregister(&b43_bcma_driver);
5312 err_sdio_exit:
5313 #endif
5314         b43_sdio_exit();
5315 err_pcmcia_exit:
5316         b43_pcmcia_exit();
5317 err_dfs_exit:
5318         b43_debugfs_exit();
5319         return err;
5320 }
5321
5322 static void __exit b43_exit(void)
5323 {
5324 #ifdef CONFIG_B43_SSB
5325         ssb_driver_unregister(&b43_ssb_driver);
5326 #endif
5327 #ifdef CONFIG_B43_BCMA
5328         bcma_driver_unregister(&b43_bcma_driver);
5329 #endif
5330         b43_sdio_exit();
5331         b43_pcmcia_exit();
5332         b43_debugfs_exit();
5333 }
5334
5335 module_init(b43_init)
5336 module_exit(b43_exit)