drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/workqueue.h>
  41 #include <linux/skbuff.h>
  42 #include <linux/io.h>
  43 #include <linux/dma-mapping.h>
  44 #include <linux/slab.h>
  45 #include <asm/unaligned.h>
  46
  47 #include "b43.h"
  48 #include "main.h"
  49 #include "debugfs.h"
  50 #include "phy_common.h"
  51 #include "phy_g.h"
  52 #include "phy_n.h"
  53 #include "dma.h"
  54 #include "pio.h"
  55 #include "sysfs.h"
  56 #include "xmit.h"
  57 #include "lo.h"
  58 #include "pcmcia.h"
  59 #include "sdio.h"
  60 #include <linux/mmc/sdio_func.h>
  61
  62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  63 MODULE_AUTHOR("Martin Langer");
  64 MODULE_AUTHOR("Stefano Brivio");
  65 MODULE_AUTHOR("Michael Buesch");
  66 MODULE_AUTHOR("Gábor Stefanik");
  67 MODULE_LICENSE("GPL");
  68
  69 MODULE_FIRMWARE("b43/ucode11.fw");
  70 MODULE_FIRMWARE("b43/ucode13.fw");
  71 MODULE_FIRMWARE("b43/ucode14.fw");
  72 MODULE_FIRMWARE("b43/ucode15.fw");
  73 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  74 MODULE_FIRMWARE("b43/ucode5.fw");
  75 MODULE_FIRMWARE("b43/ucode9.fw");
  76
  77 static int modparam_bad_frames_preempt;
  78 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  79 MODULE_PARM_DESC(bad_frames_preempt,
  80                  "enable(1) / disable(0) Bad Frames Preemption");
  81
  82 static char modparam_fwpostfix[16];
  83 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  84 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  85
  86 static int modparam_hwpctl;
  87 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  88 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  89
  90 static int modparam_nohwcrypt;
  91 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  92 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  93
  94 static int modparam_hwtkip;
  95 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  96 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  97
  98 static int modparam_qos = 1;
  99 module_param_named(qos, modparam_qos, int, 0444);
 100 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 101
 102 static int modparam_btcoex = 1;
 103 module_param_named(btcoex, modparam_btcoex, int, 0444);
 104 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 105
 106 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 107 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 108 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 109
 110 static int b43_modparam_pio = 0;
 111 module_param_named(pio, b43_modparam_pio, int, 0644);
 112 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 113
 114 #ifdef CONFIG_B43_BCMA
 115 static const struct bcma_device_id b43_bcma_tbl[] = {
 116         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 117         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 120         BCMA_CORETABLE_END
 121 };
 122 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 123 #endif
 124
 125 #ifdef CONFIG_B43_SSB
 126 static const struct ssb_device_id b43_ssb_tbl[] = {
 127         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 137         SSB_DEVTABLE_END
 138 };
 139 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 140 #endif
 141
 142 /* Channel and ratetables are shared for all devices.
 143  * They can't be const, because ieee80211 puts some precalculated
 144  * data in there. This data is the same for all devices, so we don't
 145  * get concurrency issues */
 146 #define RATETAB_ENT(_rateid, _flags) \
 147         {                                                               \
 148                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 149                 .hw_value       = (_rateid),                            \
 150                 .flags          = (_flags),                             \
 151         }
 152
 153 /*
 154  * NOTE: When changing this, sync with xmit.c's
 155  *       b43_plcp_get_bitrate_idx_* functions!
 156  */
 157 static struct ieee80211_rate __b43_ratetable[] = {
 158         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 159         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 160         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 163         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 170 };
 171
 172 #define b43_a_ratetable         (__b43_ratetable + 4)
 173 #define b43_a_ratetable_size    8
 174 #define b43_b_ratetable         (__b43_ratetable + 0)
 175 #define b43_b_ratetable_size    4
 176 #define b43_g_ratetable         (__b43_ratetable + 0)
 177 #define b43_g_ratetable_size    12
 178
 179 #define CHAN4G(_channel, _freq, _flags) {                       \
 180         .band                   = IEEE80211_BAND_2GHZ,          \
 181         .center_freq            = (_freq),                      \
 182         .hw_value               = (_channel),                   \
 183         .flags                  = (_flags),                     \
 184         .max_antenna_gain       = 0,                            \
 185         .max_power              = 30,                           \
 186 }
 187 static struct ieee80211_channel b43_2ghz_chantable[] = {
 188         CHAN4G(1, 2412, 0),
 189         CHAN4G(2, 2417, 0),
 190         CHAN4G(3, 2422, 0),
 191         CHAN4G(4, 2427, 0),
 192         CHAN4G(5, 2432, 0),
 193         CHAN4G(6, 2437, 0),
 194         CHAN4G(7, 2442, 0),
 195         CHAN4G(8, 2447, 0),
 196         CHAN4G(9, 2452, 0),
 197         CHAN4G(10, 2457, 0),
 198         CHAN4G(11, 2462, 0),
 199         CHAN4G(12, 2467, 0),
 200         CHAN4G(13, 2472, 0),
 201         CHAN4G(14, 2484, 0),
 202 };
 203 #undef CHAN4G
 204
 205 #define CHAN5G(_channel, _flags) {                              \
 206         .band                   = IEEE80211_BAND_5GHZ,          \
 207         .center_freq            = 5000 + (5 * (_channel)),      \
 208         .hw_value               = (_channel),                   \
 209         .flags                  = (_flags),                     \
 210         .max_antenna_gain       = 0,                            \
 211         .max_power              = 30,                           \
 212 }
 213 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 214         CHAN5G(32, 0),          CHAN5G(34, 0),
 215         CHAN5G(36, 0),          CHAN5G(38, 0),
 216         CHAN5G(40, 0),          CHAN5G(42, 0),
 217         CHAN5G(44, 0),          CHAN5G(46, 0),
 218         CHAN5G(48, 0),          CHAN5G(50, 0),
 219         CHAN5G(52, 0),          CHAN5G(54, 0),
 220         CHAN5G(56, 0),          CHAN5G(58, 0),
 221         CHAN5G(60, 0),          CHAN5G(62, 0),
 222         CHAN5G(64, 0),          CHAN5G(66, 0),
 223         CHAN5G(68, 0),          CHAN5G(70, 0),
 224         CHAN5G(72, 0),          CHAN5G(74, 0),
 225         CHAN5G(76, 0),          CHAN5G(78, 0),
 226         CHAN5G(80, 0),          CHAN5G(82, 0),
 227         CHAN5G(84, 0),          CHAN5G(86, 0),
 228         CHAN5G(88, 0),          CHAN5G(90, 0),
 229         CHAN5G(92, 0),          CHAN5G(94, 0),
 230         CHAN5G(96, 0),          CHAN5G(98, 0),
 231         CHAN5G(100, 0),         CHAN5G(102, 0),
 232         CHAN5G(104, 0),         CHAN5G(106, 0),
 233         CHAN5G(108, 0),         CHAN5G(110, 0),
 234         CHAN5G(112, 0),         CHAN5G(114, 0),
 235         CHAN5G(116, 0),         CHAN5G(118, 0),
 236         CHAN5G(120, 0),         CHAN5G(122, 0),
 237         CHAN5G(124, 0),         CHAN5G(126, 0),
 238         CHAN5G(128, 0),         CHAN5G(130, 0),
 239         CHAN5G(132, 0),         CHAN5G(134, 0),
 240         CHAN5G(136, 0),         CHAN5G(138, 0),
 241         CHAN5G(140, 0),         CHAN5G(142, 0),
 242         CHAN5G(144, 0),         CHAN5G(145, 0),
 243         CHAN5G(146, 0),         CHAN5G(147, 0),
 244         CHAN5G(148, 0),         CHAN5G(149, 0),
 245         CHAN5G(150, 0),         CHAN5G(151, 0),
 246         CHAN5G(152, 0),         CHAN5G(153, 0),
 247         CHAN5G(154, 0),         CHAN5G(155, 0),
 248         CHAN5G(156, 0),         CHAN5G(157, 0),
 249         CHAN5G(158, 0),         CHAN5G(159, 0),
 250         CHAN5G(160, 0),         CHAN5G(161, 0),
 251         CHAN5G(162, 0),         CHAN5G(163, 0),
 252         CHAN5G(164, 0),         CHAN5G(165, 0),
 253         CHAN5G(166, 0),         CHAN5G(168, 0),
 254         CHAN5G(170, 0),         CHAN5G(172, 0),
 255         CHAN5G(174, 0),         CHAN5G(176, 0),
 256         CHAN5G(178, 0),         CHAN5G(180, 0),
 257         CHAN5G(182, 0),         CHAN5G(184, 0),
 258         CHAN5G(186, 0),         CHAN5G(188, 0),
 259         CHAN5G(190, 0),         CHAN5G(192, 0),
 260         CHAN5G(194, 0),         CHAN5G(196, 0),
 261         CHAN5G(198, 0),         CHAN5G(200, 0),
 262         CHAN5G(202, 0),         CHAN5G(204, 0),
 263         CHAN5G(206, 0),         CHAN5G(208, 0),
 264         CHAN5G(210, 0),         CHAN5G(212, 0),
 265         CHAN5G(214, 0),         CHAN5G(216, 0),
 266         CHAN5G(218, 0),         CHAN5G(220, 0),
 267         CHAN5G(222, 0),         CHAN5G(224, 0),
 268         CHAN5G(226, 0),         CHAN5G(228, 0),
 269 };
 270
 271 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 272         CHAN5G(34, 0),          CHAN5G(36, 0),
 273         CHAN5G(38, 0),          CHAN5G(40, 0),
 274         CHAN5G(42, 0),          CHAN5G(44, 0),
 275         CHAN5G(46, 0),          CHAN5G(48, 0),
 276         CHAN5G(52, 0),          CHAN5G(56, 0),
 277         CHAN5G(60, 0),          CHAN5G(64, 0),
 278         CHAN5G(100, 0),         CHAN5G(104, 0),
 279         CHAN5G(108, 0),         CHAN5G(112, 0),
 280         CHAN5G(116, 0),         CHAN5G(120, 0),
 281         CHAN5G(124, 0),         CHAN5G(128, 0),
 282         CHAN5G(132, 0),         CHAN5G(136, 0),
 283         CHAN5G(140, 0),         CHAN5G(149, 0),
 284         CHAN5G(153, 0),         CHAN5G(157, 0),
 285         CHAN5G(161, 0),         CHAN5G(165, 0),
 286         CHAN5G(184, 0),         CHAN5G(188, 0),
 287         CHAN5G(192, 0),         CHAN5G(196, 0),
 288         CHAN5G(200, 0),         CHAN5G(204, 0),
 289         CHAN5G(208, 0),         CHAN5G(212, 0),
 290         CHAN5G(216, 0),
 291 };
 292 #undef CHAN5G
 293
 294 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 295         .band           = IEEE80211_BAND_5GHZ,
 296         .channels       = b43_5ghz_nphy_chantable,
 297         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 298         .bitrates       = b43_a_ratetable,
 299         .n_bitrates     = b43_a_ratetable_size,
 300 };
 301
 302 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 303         .band           = IEEE80211_BAND_5GHZ,
 304         .channels       = b43_5ghz_aphy_chantable,
 305         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 306         .bitrates       = b43_a_ratetable,
 307         .n_bitrates     = b43_a_ratetable_size,
 308 };
 309
 310 static struct ieee80211_supported_band b43_band_2GHz = {
 311         .band           = IEEE80211_BAND_2GHZ,
 312         .channels       = b43_2ghz_chantable,
 313         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 314         .bitrates       = b43_g_ratetable,
 315         .n_bitrates     = b43_g_ratetable_size,
 316 };
 317
 318 static void b43_wireless_core_exit(struct b43_wldev *dev);
 319 static int b43_wireless_core_init(struct b43_wldev *dev);
 320 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 321 static int b43_wireless_core_start(struct b43_wldev *dev);
 322 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 323                                     struct ieee80211_vif *vif,
 324                                     struct ieee80211_bss_conf *conf,
 325                                     u32 changed);
 326
 327 static int b43_ratelimit(struct b43_wl *wl)
 328 {
 329         if (!wl || !wl->current_dev)
 330                 return 1;
 331         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 332                 return 1;
 333         /* We are up and running.
 334          * Ratelimit the messages to avoid DoS over the net. */
 335         return net_ratelimit();
 336 }
 337
 338 void b43info(struct b43_wl *wl, const char *fmt, ...)
 339 {
 340         struct va_format vaf;
 341         va_list args;
 342
 343         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 344                 return;
 345         if (!b43_ratelimit(wl))
 346                 return;
 347
 348         va_start(args, fmt);
 349
 350         vaf.fmt = fmt;
 351         vaf.va = &args;
 352
 353         printk(KERN_INFO "b43-%s: %pV",
 354                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 355
 356         va_end(args);
 357 }
 358
 359 void b43err(struct b43_wl *wl, const char *fmt, ...)
 360 {
 361         struct va_format vaf;
 362         va_list args;
 363
 364         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 365                 return;
 366         if (!b43_ratelimit(wl))
 367                 return;
 368
 369         va_start(args, fmt);
 370
 371         vaf.fmt = fmt;
 372         vaf.va = &args;
 373
 374         printk(KERN_ERR "b43-%s ERROR: %pV",
 375                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 376
 377         va_end(args);
 378 }
 379
 380 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 381 {
 382         struct va_format vaf;
 383         va_list args;
 384
 385         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 386                 return;
 387         if (!b43_ratelimit(wl))
 388                 return;
 389
 390         va_start(args, fmt);
 391
 392         vaf.fmt = fmt;
 393         vaf.va = &args;
 394
 395         printk(KERN_WARNING "b43-%s warning: %pV",
 396                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 397
 398         va_end(args);
 399 }
 400
 401 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 402 {
 403         struct va_format vaf;
 404         va_list args;
 405
 406         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 407                 return;
 408
 409         va_start(args, fmt);
 410
 411         vaf.fmt = fmt;
 412         vaf.va = &args;
 413
 414         printk(KERN_DEBUG "b43-%s debug: %pV",
 415                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 416
 417         va_end(args);
 418 }
 419
 420 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 421 {
 422         u32 macctl;
 423
 424         B43_WARN_ON(offset % 4 != 0);
 425
 426         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 427         if (macctl & B43_MACCTL_BE)
 428                 val = swab32(val);
 429
 430         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 431         mmiowb();
 432         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 433 }
 434
 435 static inline void b43_shm_control_word(struct b43_wldev *dev,
 436                                         u16 routing, u16 offset)
 437 {
 438         u32 control;
 439
 440         /* "offset" is the WORD offset. */
 441         control = routing;
 442         control <<= 16;
 443         control |= offset;
 444         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 445 }
 446
 447 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 448 {
 449         u32 ret;
 450
 451         if (routing == B43_SHM_SHARED) {
 452                 B43_WARN_ON(offset & 0x0001);
 453                 if (offset & 0x0003) {
 454                         /* Unaligned access */
 455                         b43_shm_control_word(dev, routing, offset >> 2);
 456                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 457                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 458                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 459
 460                         goto out;
 461                 }
 462                 offset >>= 2;
 463         }
 464         b43_shm_control_word(dev, routing, offset);
 465         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 466 out:
 467         return ret;
 468 }
 469
 470 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 471 {
 472         u16 ret;
 473
 474         if (routing == B43_SHM_SHARED) {
 475                 B43_WARN_ON(offset & 0x0001);
 476                 if (offset & 0x0003) {
 477                         /* Unaligned access */
 478                         b43_shm_control_word(dev, routing, offset >> 2);
 479                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 480
 481                         goto out;
 482                 }
 483                 offset >>= 2;
 484         }
 485         b43_shm_control_word(dev, routing, offset);
 486         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 487 out:
 488         return ret;
 489 }
 490
 491 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 492 {
 493         if (routing == B43_SHM_SHARED) {
 494                 B43_WARN_ON(offset & 0x0001);
 495                 if (offset & 0x0003) {
 496                         /* Unaligned access */
 497                         b43_shm_control_word(dev, routing, offset >> 2);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 499                                     value & 0xFFFF);
 500                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 501                         b43_write16(dev, B43_MMIO_SHM_DATA,
 502                                     (value >> 16) & 0xFFFF);
 503                         return;
 504                 }
 505                 offset >>= 2;
 506         }
 507         b43_shm_control_word(dev, routing, offset);
 508         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 509 }
 510
 511 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 512 {
 513         if (routing == B43_SHM_SHARED) {
 514                 B43_WARN_ON(offset & 0x0001);
 515                 if (offset & 0x0003) {
 516                         /* Unaligned access */
 517                         b43_shm_control_word(dev, routing, offset >> 2);
 518                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 519                         return;
 520                 }
 521                 offset >>= 2;
 522         }
 523         b43_shm_control_word(dev, routing, offset);
 524         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 525 }
 526
 527 /* Read HostFlags */
 528 u64 b43_hf_read(struct b43_wldev *dev)
 529 {
 530         u64 ret;
 531
 532         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 533         ret <<= 16;
 534         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 535         ret <<= 16;
 536         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 537
 538         return ret;
 539 }
 540
 541 /* Write HostFlags */
 542 void b43_hf_write(struct b43_wldev *dev, u64 value)
 543 {
 544         u16 lo, mi, hi;
 545
 546         lo = (value & 0x00000000FFFFULL);
 547         mi = (value & 0x0000FFFF0000ULL) >> 16;
 548         hi = (value & 0xFFFF00000000ULL) >> 32;
 549         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 550         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 551         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 552 }
 553
 554 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 555 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 556 {
 557         B43_WARN_ON(!dev->fw.opensource);
 558         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 559 }
 560
 561 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 562 {
 563         u32 low, high;
 564
 565         B43_WARN_ON(dev->dev->core_rev < 3);
 566
 567         /* The hardware guarantees us an atomic read, if we
 568          * read the low register first. */
 569         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 570         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 571
 572         *tsf = high;
 573         *tsf <<= 32;
 574         *tsf |= low;
 575 }
 576
 577 static void b43_time_lock(struct b43_wldev *dev)
 578 {
 579         u32 macctl;
 580
 581         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 582         macctl |= B43_MACCTL_TBTTHOLD;
 583         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 584         /* Commit the write */
 585         b43_read32(dev, B43_MMIO_MACCTL);
 586 }
 587
 588 static void b43_time_unlock(struct b43_wldev *dev)
 589 {
 590         u32 macctl;
 591
 592         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 593         macctl &= ~B43_MACCTL_TBTTHOLD;
 594         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 595         /* Commit the write */
 596         b43_read32(dev, B43_MMIO_MACCTL);
 597 }
 598
 599 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 600 {
 601         u32 low, high;
 602
 603         B43_WARN_ON(dev->dev->core_rev < 3);
 604
 605         low = tsf;
 606         high = (tsf >> 32);
 607         /* The hardware guarantees us an atomic write, if we
 608          * write the low register first. */
 609         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 610         mmiowb();
 611         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 612         mmiowb();
 613 }
 614
 615 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 616 {
 617         b43_time_lock(dev);
 618         b43_tsf_write_locked(dev, tsf);
 619         b43_time_unlock(dev);
 620 }
 621
 622 static
 623 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 624 {
 625         static const u8 zero_addr[ETH_ALEN] = { 0 };
 626         u16 data;
 627
 628         if (!mac)
 629                 mac = zero_addr;
 630
 631         offset |= 0x0020;
 632         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 633
 634         data = mac[0];
 635         data |= mac[1] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[2];
 638         data |= mac[3] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640         data = mac[4];
 641         data |= mac[5] << 8;
 642         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 643 }
 644
 645 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 646 {
 647         const u8 *mac;
 648         const u8 *bssid;
 649         u8 mac_bssid[ETH_ALEN * 2];
 650         int i;
 651         u32 tmp;
 652
 653         bssid = dev->wl->bssid;
 654         mac = dev->wl->mac_addr;
 655
 656         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 657
 658         memcpy(mac_bssid, mac, ETH_ALEN);
 659         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 660
 661         /* Write our MAC address and BSSID to template ram */
 662         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 663                 tmp = (u32) (mac_bssid[i + 0]);
 664                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 665                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 666                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 667                 b43_ram_write(dev, 0x20 + i, tmp);
 668         }
 669 }
 670
 671 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 672 {
 673         b43_write_mac_bssid_templates(dev);
 674         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 675 }
 676
 677 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 678 {
 679         /* slot_time is in usec. */
 680         /* This test used to exit for all but a G PHY. */
 681         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 682                 return;
 683         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 684         /* Shared memory location 0x0010 is the slot time and should be
 685          * set to slot_time; however, this register is initially 0 and changing
 686          * the value adversely affects the transmit rate for BCM4311
 687          * devices. Until this behavior is unterstood, delete this step
 688          *
 689          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 690          */
 691 }
 692
 693 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 694 {
 695         b43_set_slot_time(dev, 9);
 696 }
 697
 698 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 699 {
 700         b43_set_slot_time(dev, 20);
 701 }
 702
 703 /* DummyTransmission function, as documented on
 704  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 705  */
 706 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 707 {
 708         struct b43_phy *phy = &dev->phy;
 709         unsigned int i, max_loop;
 710         u16 value;
 711         u32 buffer[5] = {
 712                 0x00000000,
 713                 0x00D40000,
 714                 0x00000000,
 715                 0x01000000,
 716                 0x00000000,
 717         };
 718
 719         if (ofdm) {
 720                 max_loop = 0x1E;
 721                 buffer[0] = 0x000201CC;
 722         } else {
 723                 max_loop = 0xFA;
 724                 buffer[0] = 0x000B846E;
 725         }
 726
 727         for (i = 0; i < 5; i++)
 728                 b43_ram_write(dev, i * 4, buffer[i]);
 729
 730         b43_write16(dev, 0x0568, 0x0000);
 731         if (dev->dev->core_rev < 11)
 732                 b43_write16(dev, 0x07C0, 0x0000);
 733         else
 734                 b43_write16(dev, 0x07C0, 0x0100);
 735         value = (ofdm ? 0x41 : 0x40);
 736         b43_write16(dev, 0x050C, value);
 737         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 738                 b43_write16(dev, 0x0514, 0x1A02);
 739         b43_write16(dev, 0x0508, 0x0000);
 740         b43_write16(dev, 0x050A, 0x0000);
 741         b43_write16(dev, 0x054C, 0x0000);
 742         b43_write16(dev, 0x056A, 0x0014);
 743         b43_write16(dev, 0x0568, 0x0826);
 744         b43_write16(dev, 0x0500, 0x0000);
 745         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 746                 //SPEC TODO
 747         }
 748
 749         switch (phy->type) {
 750         case B43_PHYTYPE_N:
 751                 b43_write16(dev, 0x0502, 0x00D0);
 752                 break;
 753         case B43_PHYTYPE_LP:
 754                 b43_write16(dev, 0x0502, 0x0050);
 755                 break;
 756         default:
 757                 b43_write16(dev, 0x0502, 0x0030);
 758         }
 759
 760         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 761                 b43_radio_write16(dev, 0x0051, 0x0017);
 762         for (i = 0x00; i < max_loop; i++) {
 763                 value = b43_read16(dev, 0x050E);
 764                 if (value & 0x0080)
 765                         break;
 766                 udelay(10);
 767         }
 768         for (i = 0x00; i < 0x0A; i++) {
 769                 value = b43_read16(dev, 0x050E);
 770                 if (value & 0x0400)
 771                         break;
 772                 udelay(10);
 773         }
 774         for (i = 0x00; i < 0x19; i++) {
 775                 value = b43_read16(dev, 0x0690);
 776                 if (!(value & 0x0100))
 777                         break;
 778                 udelay(10);
 779         }
 780         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 781                 b43_radio_write16(dev, 0x0051, 0x0037);
 782 }
 783
 784 static void key_write(struct b43_wldev *dev,
 785                       u8 index, u8 algorithm, const u8 *key)
 786 {
 787         unsigned int i;
 788         u32 offset;
 789         u16 value;
 790         u16 kidx;
 791
 792         /* Key index/algo block */
 793         kidx = b43_kidx_to_fw(dev, index);
 794         value = ((kidx << 4) | algorithm);
 795         b43_shm_write16(dev, B43_SHM_SHARED,
 796                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 797
 798         /* Write the key to the Key Table Pointer offset */
 799         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 800         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 801                 value = key[i];
 802                 value |= (u16) (key[i + 1]) << 8;
 803                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 804         }
 805 }
 806
 807 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 808 {
 809         u32 addrtmp[2] = { 0, 0, };
 810         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 811
 812         if (b43_new_kidx_api(dev))
 813                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 814
 815         B43_WARN_ON(index < pairwise_keys_start);
 816         /* We have four default TX keys and possibly four default RX keys.
 817          * Physical mac 0 is mapped to physical key 4 or 8, depending
 818          * on the firmware version.
 819          * So we must adjust the index here.
 820          */
 821         index -= pairwise_keys_start;
 822         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 823
 824         if (addr) {
 825                 addrtmp[0] = addr[0];
 826                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 827                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 828                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 829                 addrtmp[1] = addr[4];
 830                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 831         }
 832
 833         /* Receive match transmitter address (RCMTA) mechanism */
 834         b43_shm_write32(dev, B43_SHM_RCMTA,
 835                         (index * 2) + 0, addrtmp[0]);
 836         b43_shm_write16(dev, B43_SHM_RCMTA,
 837                         (index * 2) + 1, addrtmp[1]);
 838 }
 839
 840 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 841  * When a packet is received, the iv32 is checked.
 842  * - if it doesn't the packet is returned without modification (and software
 843  *   decryption can be done). That's what happen when iv16 wrap.
 844  * - if it does, the rc4 key is computed, and decryption is tried.
 845  *   Either it will success and B43_RX_MAC_DEC is returned,
 846  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 847  *   and the packet is not usable (it got modified by the ucode).
 848  * So in order to never have B43_RX_MAC_DECERR, we should provide
 849  * a iv32 and phase1key that match. Because we drop packets in case of
 850  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 851  * packets will be lost without higher layer knowing (ie no resync possible
 852  * until next wrap).
 853  *
 854  * NOTE : this should support 50 key like RCMTA because
 855  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 856  */
 857 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 858                 u16 *phase1key)
 859 {
 860         unsigned int i;
 861         u32 offset;
 862         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 863
 864         if (!modparam_hwtkip)
 865                 return;
 866
 867         if (b43_new_kidx_api(dev))
 868                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 869
 870         B43_WARN_ON(index < pairwise_keys_start);
 871         /* We have four default TX keys and possibly four default RX keys.
 872          * Physical mac 0 is mapped to physical key 4 or 8, depending
 873          * on the firmware version.
 874          * So we must adjust the index here.
 875          */
 876         index -= pairwise_keys_start;
 877         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 878
 879         if (b43_debug(dev, B43_DBG_KEYS)) {
 880                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 881                                 index, iv32);
 882         }
 883         /* Write the key to the  RX tkip shared mem */
 884         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 885         for (i = 0; i < 10; i += 2) {
 886                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 887                                 phase1key ? phase1key[i / 2] : 0);
 888         }
 889         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 890         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 891 }
 892
 893 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 894                                    struct ieee80211_vif *vif,
 895                                    struct ieee80211_key_conf *keyconf,
 896                                    struct ieee80211_sta *sta,
 897                                    u32 iv32, u16 *phase1key)
 898 {
 899         struct b43_wl *wl = hw_to_b43_wl(hw);
 900         struct b43_wldev *dev;
 901         int index = keyconf->hw_key_idx;
 902
 903         if (B43_WARN_ON(!modparam_hwtkip))
 904                 return;
 905
 906         /* This is only called from the RX path through mac80211, where
 907          * our mutex is already locked. */
 908         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 909         dev = wl->current_dev;
 910         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 911
 912         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 913
 914         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 915         /* only pairwise TKIP keys are supported right now */
 916         if (WARN_ON(!sta))
 917                 return;
 918         keymac_write(dev, index, sta->addr);
 919 }
 920
 921 static void do_key_write(struct b43_wldev *dev,
 922                          u8 index, u8 algorithm,
 923                          const u8 *key, size_t key_len, const u8 *mac_addr)
 924 {
 925         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 926         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 927
 928         if (b43_new_kidx_api(dev))
 929                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 930
 931         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 932         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 933
 934         if (index >= pairwise_keys_start)
 935                 keymac_write(dev, index, NULL); /* First zero out mac. */
 936         if (algorithm == B43_SEC_ALGO_TKIP) {
 937                 /*
 938                  * We should provide an initial iv32, phase1key pair.
 939                  * We could start with iv32=0 and compute the corresponding
 940                  * phase1key, but this means calling ieee80211_get_tkip_key
 941                  * with a fake skb (or export other tkip function).
 942                  * Because we are lazy we hope iv32 won't start with
 943                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 944                  * correct pair.
 945                  */
 946                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 947         } else if (index >= pairwise_keys_start) /* clear it */
 948                 rx_tkip_phase1_write(dev, index, 0, NULL);
 949         if (key)
 950                 memcpy(buf, key, key_len);
 951         key_write(dev, index, algorithm, buf);
 952         if (index >= pairwise_keys_start)
 953                 keymac_write(dev, index, mac_addr);
 954
 955         dev->key[index].algorithm = algorithm;
 956 }
 957
 958 static int b43_key_write(struct b43_wldev *dev,
 959                          int index, u8 algorithm,
 960                          const u8 *key, size_t key_len,
 961                          const u8 *mac_addr,
 962                          struct ieee80211_key_conf *keyconf)
 963 {
 964         int i;
 965         int pairwise_keys_start;
 966
 967         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 968          *      - Temporal Encryption Key (128 bits)
 969          *      - Temporal Authenticator Tx MIC Key (64 bits)
 970          *      - Temporal Authenticator Rx MIC Key (64 bits)
 971          *
 972          *      Hardware only store TEK
 973          */
 974         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 975                 key_len = 16;
 976         if (key_len > B43_SEC_KEYSIZE)
 977                 return -EINVAL;
 978         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 979                 /* Check that we don't already have this key. */
 980                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 981         }
 982         if (index < 0) {
 983                 /* Pairwise key. Get an empty slot for the key. */
 984                 if (b43_new_kidx_api(dev))
 985                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 986                 else
 987                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 988                 for (i = pairwise_keys_start;
 989                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 990                      i++) {
 991                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 992                         if (!dev->key[i].keyconf) {
 993                                 /* found empty */
 994                                 index = i;
 995                                 break;
 996                         }
 997                 }
 998                 if (index < 0) {
 999                         b43warn(dev->wl, "Out of hardware key memory\n");
1000                         return -ENOSPC;
1001                 }
1002         } else
1003                 B43_WARN_ON(index > 3);
1004
1005         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1006         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1007                 /* Default RX key */
1008                 B43_WARN_ON(mac_addr);
1009                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1010         }
1011         keyconf->hw_key_idx = index;
1012         dev->key[index].keyconf = keyconf;
1013
1014         return 0;
1015 }
1016
1017 static int b43_key_clear(struct b43_wldev *dev, int index)
1018 {
1019         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1020                 return -EINVAL;
1021         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1022                      NULL, B43_SEC_KEYSIZE, NULL);
1023         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1024                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1025                              NULL, B43_SEC_KEYSIZE, NULL);
1026         }
1027         dev->key[index].keyconf = NULL;
1028
1029         return 0;
1030 }
1031
1032 static void b43_clear_keys(struct b43_wldev *dev)
1033 {
1034         int i, count;
1035
1036         if (b43_new_kidx_api(dev))
1037                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1038         else
1039                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1040         for (i = 0; i < count; i++)
1041                 b43_key_clear(dev, i);
1042 }
1043
1044 static void b43_dump_keymemory(struct b43_wldev *dev)
1045 {
1046         unsigned int i, index, count, offset, pairwise_keys_start;
1047         u8 mac[ETH_ALEN];
1048         u16 algo;
1049         u32 rcmta0;
1050         u16 rcmta1;
1051         u64 hf;
1052         struct b43_key *key;
1053
1054         if (!b43_debug(dev, B43_DBG_KEYS))
1055                 return;
1056
1057         hf = b43_hf_read(dev);
1058         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1059                !!(hf & B43_HF_USEDEFKEYS));
1060         if (b43_new_kidx_api(dev)) {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1062                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1063         } else {
1064                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1065                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1066         }
1067         for (index = 0; index < count; index++) {
1068                 key = &(dev->key[index]);
1069                 printk(KERN_DEBUG "Key slot %02u: %s",
1070                        index, (key->keyconf == NULL) ? " " : "*");
1071                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1072                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1073                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1074                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1075                 }
1076
1077                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1078                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1079                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1080
1081                 if (index >= pairwise_keys_start) {
1082                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1083                                 printk("   TKIP: ");
1084                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1085                                 for (i = 0; i < 14; i += 2) {
1086                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1087                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1088                                 }
1089                         }
1090                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1091                                                 ((index - pairwise_keys_start) * 2) + 0);
1092                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1093                                                 ((index - pairwise_keys_start) * 2) + 1);
1094                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1095                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1096                         printk("   MAC: %pM", mac);
1097                 } else
1098                         printk("   DEFAULT KEY");
1099                 printk("\n");
1100         }
1101 }
1102
1103 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1104 {
1105         u32 macctl;
1106         u16 ucstat;
1107         bool hwps;
1108         bool awake;
1109         int i;
1110
1111         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1112                     (ps_flags & B43_PS_DISABLED));
1113         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1114
1115         if (ps_flags & B43_PS_ENABLED) {
1116                 hwps = 1;
1117         } else if (ps_flags & B43_PS_DISABLED) {
1118                 hwps = 0;
1119         } else {
1120                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1121                 //      and thus is not an AP and we are associated, set bit 25
1122         }
1123         if (ps_flags & B43_PS_AWAKE) {
1124                 awake = 1;
1125         } else if (ps_flags & B43_PS_ASLEEP) {
1126                 awake = 0;
1127         } else {
1128                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1129                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1130                 //      successful, set bit26
1131         }
1132
1133 /* FIXME: For now we force awake-on and hwps-off */
1134         hwps = 0;
1135         awake = 1;
1136
1137         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1138         if (hwps)
1139                 macctl |= B43_MACCTL_HWPS;
1140         else
1141                 macctl &= ~B43_MACCTL_HWPS;
1142         if (awake)
1143                 macctl |= B43_MACCTL_AWAKE;
1144         else
1145                 macctl &= ~B43_MACCTL_AWAKE;
1146         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1147         /* Commit write */
1148         b43_read32(dev, B43_MMIO_MACCTL);
1149         if (awake && dev->dev->core_rev >= 5) {
1150                 /* Wait for the microcode to wake up. */
1151                 for (i = 0; i < 100; i++) {
1152                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1153                                                 B43_SHM_SH_UCODESTAT);
1154                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1155                                 break;
1156                         udelay(10);
1157                 }
1158         }
1159 }
1160
1161 #ifdef CONFIG_B43_BCMA
1162 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1163 {
1164         u32 flags;
1165
1166         /* Put PHY into reset */
1167         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1168         flags |= B43_BCMA_IOCTL_PHY_RESET;
1169         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1170         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1171         udelay(2);
1172
1173         /* Take PHY out of reset */
1174         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1175         flags &= ~B43_BCMA_IOCTL_PHY_RESET;
1176         flags |= BCMA_IOCTL_FGC;
1177         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1178         udelay(1);
1179
1180         /* Do not force clock anymore */
1181         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1182         flags &= ~BCMA_IOCTL_FGC;
1183         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1184         udelay(1);
1185 }
1186
1187 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1188 {
1189         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
1190         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1191         b43_bcma_phy_reset(dev);
1192         bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
1193 }
1194 #endif
1195
1196 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1197 {
1198         struct ssb_device *sdev = dev->dev->sdev;
1199         u32 tmslow;
1200         u32 flags = 0;
1201
1202         if (gmode)
1203                 flags |= B43_TMSLOW_GMODE;
1204         flags |= B43_TMSLOW_PHYCLKEN;
1205         flags |= B43_TMSLOW_PHYRESET;
1206         if (dev->phy.type == B43_PHYTYPE_N)
1207                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1208         b43_device_enable(dev, flags);
1209         msleep(2);              /* Wait for the PLL to turn on. */
1210
1211         /* Now take the PHY out of Reset again */
1212         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1213         tmslow |= SSB_TMSLOW_FGC;
1214         tmslow &= ~B43_TMSLOW_PHYRESET;
1215         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1216         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1217         msleep(1);
1218         tmslow &= ~SSB_TMSLOW_FGC;
1219         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1220         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1221         msleep(1);
1222 }
1223
1224 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1225 {
1226         u32 macctl;
1227
1228         switch (dev->dev->bus_type) {
1229 #ifdef CONFIG_B43_BCMA
1230         case B43_BUS_BCMA:
1231                 b43_bcma_wireless_core_reset(dev, gmode);
1232                 break;
1233 #endif
1234 #ifdef CONFIG_B43_SSB
1235         case B43_BUS_SSB:
1236                 b43_ssb_wireless_core_reset(dev, gmode);
1237                 break;
1238 #endif
1239         }
1240
1241         /* Turn Analog ON, but only if we already know the PHY-type.
1242          * This protects against very early setup where we don't know the
1243          * PHY-type, yet. wireless_core_reset will be called once again later,
1244          * when we know the PHY-type. */
1245         if (dev->phy.ops)
1246                 dev->phy.ops->switch_analog(dev, 1);
1247
1248         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1249         macctl &= ~B43_MACCTL_GMODE;
1250         if (gmode)
1251                 macctl |= B43_MACCTL_GMODE;
1252         macctl |= B43_MACCTL_IHR_ENABLED;
1253         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1254 }
1255
1256 static void handle_irq_transmit_status(struct b43_wldev *dev)
1257 {
1258         u32 v0, v1;
1259         u16 tmp;
1260         struct b43_txstatus stat;
1261
1262         while (1) {
1263                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1264                 if (!(v0 & 0x00000001))
1265                         break;
1266                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1267
1268                 stat.cookie = (v0 >> 16);
1269                 stat.seq = (v1 & 0x0000FFFF);
1270                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1271                 tmp = (v0 & 0x0000FFFF);
1272                 stat.frame_count = ((tmp & 0xF000) >> 12);
1273                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1274                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1275                 stat.pm_indicated = !!(tmp & 0x0080);
1276                 stat.intermediate = !!(tmp & 0x0040);
1277                 stat.for_ampdu = !!(tmp & 0x0020);
1278                 stat.acked = !!(tmp & 0x0002);
1279
1280                 b43_handle_txstatus(dev, &stat);
1281         }
1282 }
1283
1284 static void drain_txstatus_queue(struct b43_wldev *dev)
1285 {
1286         u32 dummy;
1287
1288         if (dev->dev->core_rev < 5)
1289                 return;
1290         /* Read all entries from the microcode TXstatus FIFO
1291          * and throw them away.
1292          */
1293         while (1) {
1294                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1295                 if (!(dummy & 0x00000001))
1296                         break;
1297                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1298         }
1299 }
1300
1301 static u32 b43_jssi_read(struct b43_wldev *dev)
1302 {
1303         u32 val = 0;
1304
1305         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1306         val <<= 16;
1307         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1308
1309         return val;
1310 }
1311
1312 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1313 {
1314         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1315         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1316 }
1317
1318 static void b43_generate_noise_sample(struct b43_wldev *dev)
1319 {
1320         b43_jssi_write(dev, 0x7F7F7F7F);
1321         b43_write32(dev, B43_MMIO_MACCMD,
1322                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1323 }
1324
1325 static void b43_calculate_link_quality(struct b43_wldev *dev)
1326 {
1327         /* Top half of Link Quality calculation. */
1328
1329         if (dev->phy.type != B43_PHYTYPE_G)
1330                 return;
1331         if (dev->noisecalc.calculation_running)
1332                 return;
1333         dev->noisecalc.calculation_running = 1;
1334         dev->noisecalc.nr_samples = 0;
1335
1336         b43_generate_noise_sample(dev);
1337 }
1338
1339 static void handle_irq_noise(struct b43_wldev *dev)
1340 {
1341         struct b43_phy_g *phy = dev->phy.g;
1342         u16 tmp;
1343         u8 noise[4];
1344         u8 i, j;
1345         s32 average;
1346
1347         /* Bottom half of Link Quality calculation. */
1348
1349         if (dev->phy.type != B43_PHYTYPE_G)
1350                 return;
1351
1352         /* Possible race condition: It might be possible that the user
1353          * changed to a different channel in the meantime since we
1354          * started the calculation. We ignore that fact, since it's
1355          * not really that much of a problem. The background noise is
1356          * an estimation only anyway. Slightly wrong results will get damped
1357          * by the averaging of the 8 sample rounds. Additionally the
1358          * value is shortlived. So it will be replaced by the next noise
1359          * calculation round soon. */
1360
1361         B43_WARN_ON(!dev->noisecalc.calculation_running);
1362         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1363         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1364             noise[2] == 0x7F || noise[3] == 0x7F)
1365                 goto generate_new;
1366
1367         /* Get the noise samples. */
1368         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1369         i = dev->noisecalc.nr_samples;
1370         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1371         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1372         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1373         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1374         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1375         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1376         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1377         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1378         dev->noisecalc.nr_samples++;
1379         if (dev->noisecalc.nr_samples == 8) {
1380                 /* Calculate the Link Quality by the noise samples. */
1381                 average = 0;
1382                 for (i = 0; i < 8; i++) {
1383                         for (j = 0; j < 4; j++)
1384                                 average += dev->noisecalc.samples[i][j];
1385                 }
1386                 average /= (8 * 4);
1387                 average *= 125;
1388                 average += 64;
1389                 average /= 128;
1390                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1391                 tmp = (tmp / 128) & 0x1F;
1392                 if (tmp >= 8)
1393                         average += 2;
1394                 else
1395                         average -= 25;
1396                 if (tmp == 8)
1397                         average -= 72;
1398                 else
1399                         average -= 48;
1400
1401                 dev->stats.link_noise = average;
1402                 dev->noisecalc.calculation_running = 0;
1403                 return;
1404         }
1405 generate_new:
1406         b43_generate_noise_sample(dev);
1407 }
1408
1409 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1410 {
1411         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1412                 ///TODO: PS TBTT
1413         } else {
1414                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1415                         b43_power_saving_ctl_bits(dev, 0);
1416         }
1417         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1418                 dev->dfq_valid = 1;
1419 }
1420
1421 static void handle_irq_atim_end(struct b43_wldev *dev)
1422 {
1423         if (dev->dfq_valid) {
1424                 b43_write32(dev, B43_MMIO_MACCMD,
1425                             b43_read32(dev, B43_MMIO_MACCMD)
1426                             | B43_MACCMD_DFQ_VALID);
1427                 dev->dfq_valid = 0;
1428         }
1429 }
1430
1431 static void handle_irq_pmq(struct b43_wldev *dev)
1432 {
1433         u32 tmp;
1434
1435         //TODO: AP mode.
1436
1437         while (1) {
1438                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1439                 if (!(tmp & 0x00000008))
1440                         break;
1441         }
1442         /* 16bit write is odd, but correct. */
1443         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1444 }
1445
1446 static void b43_write_template_common(struct b43_wldev *dev,
1447                                       const u8 *data, u16 size,
1448                                       u16 ram_offset,
1449                                       u16 shm_size_offset, u8 rate)
1450 {
1451         u32 i, tmp;
1452         struct b43_plcp_hdr4 plcp;
1453
1454         plcp.data = 0;
1455         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1456         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1457         ram_offset += sizeof(u32);
1458         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1459          * So leave the first two bytes of the next write blank.
1460          */
1461         tmp = (u32) (data[0]) << 16;
1462         tmp |= (u32) (data[1]) << 24;
1463         b43_ram_write(dev, ram_offset, tmp);
1464         ram_offset += sizeof(u32);
1465         for (i = 2; i < size; i += sizeof(u32)) {
1466                 tmp = (u32) (data[i + 0]);
1467                 if (i + 1 < size)
1468                         tmp |= (u32) (data[i + 1]) << 8;
1469                 if (i + 2 < size)
1470                         tmp |= (u32) (data[i + 2]) << 16;
1471                 if (i + 3 < size)
1472                         tmp |= (u32) (data[i + 3]) << 24;
1473                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1474         }
1475         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1476                         size + sizeof(struct b43_plcp_hdr6));
1477 }
1478
1479 /* Check if the use of the antenna that ieee80211 told us to
1480  * use is possible. This will fall back to DEFAULT.
1481  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1482 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1483                                   u8 antenna_nr)
1484 {
1485         u8 antenna_mask;
1486
1487         if (antenna_nr == 0) {
1488                 /* Zero means "use default antenna". That's always OK. */
1489                 return 0;
1490         }
1491
1492         /* Get the mask of available antennas. */
1493         if (dev->phy.gmode)
1494                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1495         else
1496                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1497
1498         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1499                 /* This antenna is not available. Fall back to default. */
1500                 return 0;
1501         }
1502
1503         return antenna_nr;
1504 }
1505
1506 /* Convert a b43 antenna number value to the PHY TX control value. */
1507 static u16 b43_antenna_to_phyctl(int antenna)
1508 {
1509         switch (antenna) {
1510         case B43_ANTENNA0:
1511                 return B43_TXH_PHY_ANT0;
1512         case B43_ANTENNA1:
1513                 return B43_TXH_PHY_ANT1;
1514         case B43_ANTENNA2:
1515                 return B43_TXH_PHY_ANT2;
1516         case B43_ANTENNA3:
1517                 return B43_TXH_PHY_ANT3;
1518         case B43_ANTENNA_AUTO0:
1519         case B43_ANTENNA_AUTO1:
1520                 return B43_TXH_PHY_ANT01AUTO;
1521         }
1522         B43_WARN_ON(1);
1523         return 0;
1524 }
1525
1526 static void b43_write_beacon_template(struct b43_wldev *dev,
1527                                       u16 ram_offset,
1528                                       u16 shm_size_offset)
1529 {
1530         unsigned int i, len, variable_len;
1531         const struct ieee80211_mgmt *bcn;
1532         const u8 *ie;
1533         bool tim_found = 0;
1534         unsigned int rate;
1535         u16 ctl;
1536         int antenna;
1537         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1538
1539         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1540         len = min((size_t) dev->wl->current_beacon->len,
1541                   0x200 - sizeof(struct b43_plcp_hdr6));
1542         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1543
1544         b43_write_template_common(dev, (const u8 *)bcn,
1545                                   len, ram_offset, shm_size_offset, rate);
1546
1547         /* Write the PHY TX control parameters. */
1548         antenna = B43_ANTENNA_DEFAULT;
1549         antenna = b43_antenna_to_phyctl(antenna);
1550         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1551         /* We can't send beacons with short preamble. Would get PHY errors. */
1552         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1553         ctl &= ~B43_TXH_PHY_ANT;
1554         ctl &= ~B43_TXH_PHY_ENC;
1555         ctl |= antenna;
1556         if (b43_is_cck_rate(rate))
1557                 ctl |= B43_TXH_PHY_ENC_CCK;
1558         else
1559                 ctl |= B43_TXH_PHY_ENC_OFDM;
1560         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1561
1562         /* Find the position of the TIM and the DTIM_period value
1563          * and write them to SHM. */
1564         ie = bcn->u.beacon.variable;
1565         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1566         for (i = 0; i < variable_len - 2; ) {
1567                 uint8_t ie_id, ie_len;
1568
1569                 ie_id = ie[i];
1570                 ie_len = ie[i + 1];
1571                 if (ie_id == 5) {
1572                         u16 tim_position;
1573                         u16 dtim_period;
1574                         /* This is the TIM Information Element */
1575
1576                         /* Check whether the ie_len is in the beacon data range. */
1577                         if (variable_len < ie_len + 2 + i)
1578                                 break;
1579                         /* A valid TIM is at least 4 bytes long. */
1580                         if (ie_len < 4)
1581                                 break;
1582                         tim_found = 1;
1583
1584                         tim_position = sizeof(struct b43_plcp_hdr6);
1585                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1586                         tim_position += i;
1587
1588                         dtim_period = ie[i + 3];
1589
1590                         b43_shm_write16(dev, B43_SHM_SHARED,
1591                                         B43_SHM_SH_TIMBPOS, tim_position);
1592                         b43_shm_write16(dev, B43_SHM_SHARED,
1593                                         B43_SHM_SH_DTIMPER, dtim_period);
1594                         break;
1595                 }
1596                 i += ie_len + 2;
1597         }
1598         if (!tim_found) {
1599                 /*
1600                  * If ucode wants to modify TIM do it behind the beacon, this
1601                  * will happen, for example, when doing mesh networking.
1602                  */
1603                 b43_shm_write16(dev, B43_SHM_SHARED,
1604                                 B43_SHM_SH_TIMBPOS,
1605                                 len + sizeof(struct b43_plcp_hdr6));
1606                 b43_shm_write16(dev, B43_SHM_SHARED,
1607                                 B43_SHM_SH_DTIMPER, 0);
1608         }
1609         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1610 }
1611
1612 static void b43_upload_beacon0(struct b43_wldev *dev)
1613 {
1614         struct b43_wl *wl = dev->wl;
1615
1616         if (wl->beacon0_uploaded)
1617                 return;
1618         b43_write_beacon_template(dev, 0x68, 0x18);
1619         wl->beacon0_uploaded = 1;
1620 }
1621
1622 static void b43_upload_beacon1(struct b43_wldev *dev)
1623 {
1624         struct b43_wl *wl = dev->wl;
1625
1626         if (wl->beacon1_uploaded)
1627                 return;
1628         b43_write_beacon_template(dev, 0x468, 0x1A);
1629         wl->beacon1_uploaded = 1;
1630 }
1631
1632 static void handle_irq_beacon(struct b43_wldev *dev)
1633 {
1634         struct b43_wl *wl = dev->wl;
1635         u32 cmd, beacon0_valid, beacon1_valid;
1636
1637         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1638             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1639                 return;
1640
1641         /* This is the bottom half of the asynchronous beacon update. */
1642
1643         /* Ignore interrupt in the future. */
1644         dev->irq_mask &= ~B43_IRQ_BEACON;
1645
1646         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1647         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1648         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1649
1650         /* Schedule interrupt manually, if busy. */
1651         if (beacon0_valid && beacon1_valid) {
1652                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1653                 dev->irq_mask |= B43_IRQ_BEACON;
1654                 return;
1655         }
1656
1657         if (unlikely(wl->beacon_templates_virgin)) {
1658                 /* We never uploaded a beacon before.
1659                  * Upload both templates now, but only mark one valid. */
1660                 wl->beacon_templates_virgin = 0;
1661                 b43_upload_beacon0(dev);
1662                 b43_upload_beacon1(dev);
1663                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1664                 cmd |= B43_MACCMD_BEACON0_VALID;
1665                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1666         } else {
1667                 if (!beacon0_valid) {
1668                         b43_upload_beacon0(dev);
1669                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1670                         cmd |= B43_MACCMD_BEACON0_VALID;
1671                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1672                 } else if (!beacon1_valid) {
1673                         b43_upload_beacon1(dev);
1674                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1675                         cmd |= B43_MACCMD_BEACON1_VALID;
1676                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1677                 }
1678         }
1679 }
1680
1681 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1682 {
1683         u32 old_irq_mask = dev->irq_mask;
1684
1685         /* update beacon right away or defer to irq */
1686         handle_irq_beacon(dev);
1687         if (old_irq_mask != dev->irq_mask) {
1688                 /* The handler updated the IRQ mask. */
1689                 B43_WARN_ON(!dev->irq_mask);
1690                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1691                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1692                 } else {
1693                         /* Device interrupts are currently disabled. That means
1694                          * we just ran the hardirq handler and scheduled the
1695                          * IRQ thread. The thread will write the IRQ mask when
1696                          * it finished, so there's nothing to do here. Writing
1697                          * the mask _here_ would incorrectly re-enable IRQs. */
1698                 }
1699         }
1700 }
1701
1702 static void b43_beacon_update_trigger_work(struct work_struct *work)
1703 {
1704         struct b43_wl *wl = container_of(work, struct b43_wl,
1705                                          beacon_update_trigger);
1706         struct b43_wldev *dev;
1707
1708         mutex_lock(&wl->mutex);
1709         dev = wl->current_dev;
1710         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1711                 if (b43_bus_host_is_sdio(dev->dev)) {
1712                         /* wl->mutex is enough. */
1713                         b43_do_beacon_update_trigger_work(dev);
1714                         mmiowb();
1715                 } else {
1716                         spin_lock_irq(&wl->hardirq_lock);
1717                         b43_do_beacon_update_trigger_work(dev);
1718                         mmiowb();
1719                         spin_unlock_irq(&wl->hardirq_lock);
1720                 }
1721         }
1722         mutex_unlock(&wl->mutex);
1723 }
1724
1725 /* Asynchronously update the packet templates in template RAM.
1726  * Locking: Requires wl->mutex to be locked. */
1727 static void b43_update_templates(struct b43_wl *wl)
1728 {
1729         struct sk_buff *beacon;
1730
1731         /* This is the top half of the ansynchronous beacon update.
1732          * The bottom half is the beacon IRQ.
1733          * Beacon update must be asynchronous to avoid sending an
1734          * invalid beacon. This can happen for example, if the firmware
1735          * transmits a beacon while we are updating it. */
1736
1737         /* We could modify the existing beacon and set the aid bit in
1738          * the TIM field, but that would probably require resizing and
1739          * moving of data within the beacon template.
1740          * Simply request a new beacon and let mac80211 do the hard work. */
1741         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1742         if (unlikely(!beacon))
1743                 return;
1744
1745         if (wl->current_beacon)
1746                 dev_kfree_skb_any(wl->current_beacon);
1747         wl->current_beacon = beacon;
1748         wl->beacon0_uploaded = 0;
1749         wl->beacon1_uploaded = 0;
1750         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1751 }
1752
1753 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1754 {
1755         b43_time_lock(dev);
1756         if (dev->dev->core_rev >= 3) {
1757                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1758                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1759         } else {
1760                 b43_write16(dev, 0x606, (beacon_int >> 6));
1761                 b43_write16(dev, 0x610, beacon_int);
1762         }
1763         b43_time_unlock(dev);
1764         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1765 }
1766
1767 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1768 {
1769         u16 reason;
1770
1771         /* Read the register that contains the reason code for the panic. */
1772         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1773         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1774
1775         switch (reason) {
1776         default:
1777                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1778                 /* fallthrough */
1779         case B43_FWPANIC_DIE:
1780                 /* Do not restart the controller or firmware.
1781                  * The device is nonfunctional from now on.
1782                  * Restarting would result in this panic to trigger again,
1783                  * so we avoid that recursion. */
1784                 break;
1785         case B43_FWPANIC_RESTART:
1786                 b43_controller_restart(dev, "Microcode panic");
1787                 break;
1788         }
1789 }
1790
1791 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1792 {
1793         unsigned int i, cnt;
1794         u16 reason, marker_id, marker_line;
1795         __le16 *buf;
1796
1797         /* The proprietary firmware doesn't have this IRQ. */
1798         if (!dev->fw.opensource)
1799                 return;
1800
1801         /* Read the register that contains the reason code for this IRQ. */
1802         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1803
1804         switch (reason) {
1805         case B43_DEBUGIRQ_PANIC:
1806                 b43_handle_firmware_panic(dev);
1807                 break;
1808         case B43_DEBUGIRQ_DUMP_SHM:
1809                 if (!B43_DEBUG)
1810                         break; /* Only with driver debugging enabled. */
1811                 buf = kmalloc(4096, GFP_ATOMIC);
1812                 if (!buf) {
1813                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1814                         goto out;
1815                 }
1816                 for (i = 0; i < 4096; i += 2) {
1817                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1818                         buf[i / 2] = cpu_to_le16(tmp);
1819                 }
1820                 b43info(dev->wl, "Shared memory dump:\n");
1821                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1822                                16, 2, buf, 4096, 1);
1823                 kfree(buf);
1824                 break;
1825         case B43_DEBUGIRQ_DUMP_REGS:
1826                 if (!B43_DEBUG)
1827                         break; /* Only with driver debugging enabled. */
1828                 b43info(dev->wl, "Microcode register dump:\n");
1829                 for (i = 0, cnt = 0; i < 64; i++) {
1830                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1831                         if (cnt == 0)
1832                                 printk(KERN_INFO);
1833                         printk("r%02u: 0x%04X  ", i, tmp);
1834                         cnt++;
1835                         if (cnt == 6) {
1836                                 printk("\n");
1837                                 cnt = 0;
1838                         }
1839                 }
1840                 printk("\n");
1841                 break;
1842         case B43_DEBUGIRQ_MARKER:
1843                 if (!B43_DEBUG)
1844                         break; /* Only with driver debugging enabled. */
1845                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1846                                            B43_MARKER_ID_REG);
1847                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1848                                              B43_MARKER_LINE_REG);
1849                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1850                         "at line number %u\n",
1851                         marker_id, marker_line);
1852                 break;
1853         default:
1854                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1855                        reason);
1856         }
1857 out:
1858         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1859         b43_shm_write16(dev, B43_SHM_SCRATCH,
1860                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1861 }
1862
1863 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1864 {
1865         u32 reason;
1866         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1867         u32 merged_dma_reason = 0;
1868         int i;
1869
1870         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1871                 return;
1872
1873         reason = dev->irq_reason;
1874         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1875                 dma_reason[i] = dev->dma_reason[i];
1876                 merged_dma_reason |= dma_reason[i];
1877         }
1878
1879         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1880                 b43err(dev->wl, "MAC transmission error\n");
1881
1882         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1883                 b43err(dev->wl, "PHY transmission error\n");
1884                 rmb();
1885                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1886                         atomic_set(&dev->phy.txerr_cnt,
1887                                    B43_PHY_TX_BADNESS_LIMIT);
1888                         b43err(dev->wl, "Too many PHY TX errors, "
1889                                         "restarting the controller\n");
1890                         b43_controller_restart(dev, "PHY TX errors");
1891                 }
1892         }
1893
1894         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1895                                           B43_DMAIRQ_NONFATALMASK))) {
1896                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1897                         b43err(dev->wl, "Fatal DMA error: "
1898                                "0x%08X, 0x%08X, 0x%08X, "
1899                                "0x%08X, 0x%08X, 0x%08X\n",
1900                                dma_reason[0], dma_reason[1],
1901                                dma_reason[2], dma_reason[3],
1902                                dma_reason[4], dma_reason[5]);
1903                         b43err(dev->wl, "This device does not support DMA "
1904                                "on your system. It will now be switched to PIO.\n");
1905                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1906                         dev->use_pio = 1;
1907                         b43_controller_restart(dev, "DMA error");
1908                         return;
1909                 }
1910                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1911                         b43err(dev->wl, "DMA error: "
1912                                "0x%08X, 0x%08X, 0x%08X, "
1913                                "0x%08X, 0x%08X, 0x%08X\n",
1914                                dma_reason[0], dma_reason[1],
1915                                dma_reason[2], dma_reason[3],
1916                                dma_reason[4], dma_reason[5]);
1917                 }
1918         }
1919
1920         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1921                 handle_irq_ucode_debug(dev);
1922         if (reason & B43_IRQ_TBTT_INDI)
1923                 handle_irq_tbtt_indication(dev);
1924         if (reason & B43_IRQ_ATIM_END)
1925                 handle_irq_atim_end(dev);
1926         if (reason & B43_IRQ_BEACON)
1927                 handle_irq_beacon(dev);
1928         if (reason & B43_IRQ_PMQ)
1929                 handle_irq_pmq(dev);
1930         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1931                 ;/* TODO */
1932         if (reason & B43_IRQ_NOISESAMPLE_OK)
1933                 handle_irq_noise(dev);
1934
1935         /* Check the DMA reason registers for received data. */
1936         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1937                 if (b43_using_pio_transfers(dev))
1938                         b43_pio_rx(dev->pio.rx_queue);
1939                 else
1940                         b43_dma_rx(dev->dma.rx_ring);
1941         }
1942         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1943         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1944         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1945         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1946         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1947
1948         if (reason & B43_IRQ_TX_OK)
1949                 handle_irq_transmit_status(dev);
1950
1951         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1952         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1953
1954 #if B43_DEBUG
1955         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1956                 dev->irq_count++;
1957                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1958                         if (reason & (1 << i))
1959                                 dev->irq_bit_count[i]++;
1960                 }
1961         }
1962 #endif
1963 }
1964
1965 /* Interrupt thread handler. Handles device interrupts in thread context. */
1966 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1967 {
1968         struct b43_wldev *dev = dev_id;
1969
1970         mutex_lock(&dev->wl->mutex);
1971         b43_do_interrupt_thread(dev);
1972         mmiowb();
1973         mutex_unlock(&dev->wl->mutex);
1974
1975         return IRQ_HANDLED;
1976 }
1977
1978 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1979 {
1980         u32 reason;
1981
1982         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1983          * On SDIO, this runs under wl->mutex. */
1984
1985         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1986         if (reason == 0xffffffff)       /* shared IRQ */
1987                 return IRQ_NONE;
1988         reason &= dev->irq_mask;
1989         if (!reason)
1990                 return IRQ_NONE;
1991
1992         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1993             & 0x0001DC00;
1994         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1995             & 0x0000DC00;
1996         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1997             & 0x0000DC00;
1998         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1999             & 0x0001DC00;
2000         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2001             & 0x0000DC00;
2002 /* Unused ring
2003         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2004             & 0x0000DC00;
2005 */
2006
2007         /* ACK the interrupt. */
2008         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2009         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2010         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2011         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2012         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2013         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2014 /* Unused ring
2015         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2016 */
2017
2018         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2019         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2020         /* Save the reason bitmasks for the IRQ thread handler. */
2021         dev->irq_reason = reason;
2022
2023         return IRQ_WAKE_THREAD;
2024 }
2025
2026 /* Interrupt handler top-half. This runs with interrupts disabled. */
2027 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2028 {
2029         struct b43_wldev *dev = dev_id;
2030         irqreturn_t ret;
2031
2032         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2033                 return IRQ_NONE;
2034
2035         spin_lock(&dev->wl->hardirq_lock);
2036         ret = b43_do_interrupt(dev);
2037         mmiowb();
2038         spin_unlock(&dev->wl->hardirq_lock);
2039
2040         return ret;
2041 }
2042
2043 /* SDIO interrupt handler. This runs in process context. */
2044 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2045 {
2046         struct b43_wl *wl = dev->wl;
2047         irqreturn_t ret;
2048
2049         mutex_lock(&wl->mutex);
2050
2051         ret = b43_do_interrupt(dev);
2052         if (ret == IRQ_WAKE_THREAD)
2053                 b43_do_interrupt_thread(dev);
2054
2055         mutex_unlock(&wl->mutex);
2056 }
2057
2058 void b43_do_release_fw(struct b43_firmware_file *fw)
2059 {
2060         release_firmware(fw->data);
2061         fw->data = NULL;
2062         fw->filename = NULL;
2063 }
2064
2065 static void b43_release_firmware(struct b43_wldev *dev)
2066 {
2067         b43_do_release_fw(&dev->fw.ucode);
2068         b43_do_release_fw(&dev->fw.pcm);
2069         b43_do_release_fw(&dev->fw.initvals);
2070         b43_do_release_fw(&dev->fw.initvals_band);
2071 }
2072
2073 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2074 {
2075         const char text[] =
2076                 "You must go to " \
2077                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2078                 "and download the correct firmware for this driver version. " \
2079                 "Please carefully read all instructions on this website.\n";
2080
2081         if (error)
2082                 b43err(wl, text);
2083         else
2084                 b43warn(wl, text);
2085 }
2086
2087 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2088                       const char *name,
2089                       struct b43_firmware_file *fw)
2090 {
2091         const struct firmware *blob;
2092         struct b43_fw_header *hdr;
2093         u32 size;
2094         int err;
2095
2096         if (!name) {
2097                 /* Don't fetch anything. Free possibly cached firmware. */
2098                 /* FIXME: We should probably keep it anyway, to save some headache
2099                  * on suspend/resume with multiband devices. */
2100                 b43_do_release_fw(fw);
2101                 return 0;
2102         }
2103         if (fw->filename) {
2104                 if ((fw->type == ctx->req_type) &&
2105                     (strcmp(fw->filename, name) == 0))
2106                         return 0; /* Already have this fw. */
2107                 /* Free the cached firmware first. */
2108                 /* FIXME: We should probably do this later after we successfully
2109                  * got the new fw. This could reduce headache with multiband devices.
2110                  * We could also redesign this to cache the firmware for all possible
2111                  * bands all the time. */
2112                 b43_do_release_fw(fw);
2113         }
2114
2115         switch (ctx->req_type) {
2116         case B43_FWTYPE_PROPRIETARY:
2117                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2118                          "b43%s/%s.fw",
2119                          modparam_fwpostfix, name);
2120                 break;
2121         case B43_FWTYPE_OPENSOURCE:
2122                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2123                          "b43-open%s/%s.fw",
2124                          modparam_fwpostfix, name);
2125                 break;
2126         default:
2127                 B43_WARN_ON(1);
2128                 return -ENOSYS;
2129         }
2130         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2131         if (err == -ENOENT) {
2132                 snprintf(ctx->errors[ctx->req_type],
2133                          sizeof(ctx->errors[ctx->req_type]),
2134                          "Firmware file \"%s\" not found\n", ctx->fwname);
2135                 return err;
2136         } else if (err) {
2137                 snprintf(ctx->errors[ctx->req_type],
2138                          sizeof(ctx->errors[ctx->req_type]),
2139                          "Firmware file \"%s\" request failed (err=%d)\n",
2140                          ctx->fwname, err);
2141                 return err;
2142         }
2143         if (blob->size < sizeof(struct b43_fw_header))
2144                 goto err_format;
2145         hdr = (struct b43_fw_header *)(blob->data);
2146         switch (hdr->type) {
2147         case B43_FW_TYPE_UCODE:
2148         case B43_FW_TYPE_PCM:
2149                 size = be32_to_cpu(hdr->size);
2150                 if (size != blob->size - sizeof(struct b43_fw_header))
2151                         goto err_format;
2152                 /* fallthrough */
2153         case B43_FW_TYPE_IV:
2154                 if (hdr->ver != 1)
2155                         goto err_format;
2156                 break;
2157         default:
2158                 goto err_format;
2159         }
2160
2161         fw->data = blob;
2162         fw->filename = name;
2163         fw->type = ctx->req_type;
2164
2165         return 0;
2166
2167 err_format:
2168         snprintf(ctx->errors[ctx->req_type],
2169                  sizeof(ctx->errors[ctx->req_type]),
2170                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2171         release_firmware(blob);
2172
2173         return -EPROTO;
2174 }
2175
2176 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2177 {
2178         struct b43_wldev *dev = ctx->dev;
2179         struct b43_firmware *fw = &ctx->dev->fw;
2180         const u8 rev = ctx->dev->dev->core_rev;
2181         const char *filename;
2182         u32 tmshigh;
2183         int err;
2184
2185         /* Files for HT and LCN were found by trying one by one */
2186
2187         /* Get microcode */
2188         if ((rev >= 5) && (rev <= 10)) {
2189                 filename = "ucode5";
2190         } else if ((rev >= 11) && (rev <= 12)) {
2191                 filename = "ucode11";
2192         } else if (rev == 13) {
2193                 filename = "ucode13";
2194         } else if (rev == 14) {
2195                 filename = "ucode14";
2196         } else if (rev == 15) {
2197                 filename = "ucode15";
2198         } else {
2199                 switch (dev->phy.type) {
2200                 case B43_PHYTYPE_N:
2201                         if (rev >= 16)
2202                                 filename = "ucode16_mimo";
2203                         else
2204                                 goto err_no_ucode;
2205                         break;
2206                 case B43_PHYTYPE_HT:
2207                         if (rev == 29)
2208                                 filename = "ucode29_mimo";
2209                         else
2210                                 goto err_no_ucode;
2211                         break;
2212                 case B43_PHYTYPE_LCN:
2213                         if (rev == 24)
2214                                 filename = "ucode24_mimo";
2215                         else
2216                                 goto err_no_ucode;
2217                         break;
2218                 default:
2219                         goto err_no_ucode;
2220                 }
2221         }
2222         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2223         if (err)
2224                 goto err_load;
2225
2226         /* Get PCM code */
2227         if ((rev >= 5) && (rev <= 10))
2228                 filename = "pcm5";
2229         else if (rev >= 11)
2230                 filename = NULL;
2231         else
2232                 goto err_no_pcm;
2233         fw->pcm_request_failed = 0;
2234         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2235         if (err == -ENOENT) {
2236                 /* We did not find a PCM file? Not fatal, but
2237                  * core rev <= 10 must do without hwcrypto then. */
2238                 fw->pcm_request_failed = 1;
2239         } else if (err)
2240                 goto err_load;
2241
2242         /* Get initvals */
2243         switch (dev->phy.type) {
2244         case B43_PHYTYPE_A:
2245                 if ((rev >= 5) && (rev <= 10)) {
2246                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2247                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2248                                 filename = "a0g1initvals5";
2249                         else
2250                                 filename = "a0g0initvals5";
2251                 } else
2252                         goto err_no_initvals;
2253                 break;
2254         case B43_PHYTYPE_G:
2255                 if ((rev >= 5) && (rev <= 10))
2256                         filename = "b0g0initvals5";
2257                 else if (rev >= 13)
2258                         filename = "b0g0initvals13";
2259                 else
2260                         goto err_no_initvals;
2261                 break;
2262         case B43_PHYTYPE_N:
2263                 if (rev >= 16)
2264                         filename = "n0initvals16";
2265                 else if ((rev >= 11) && (rev <= 12))
2266                         filename = "n0initvals11";
2267                 else
2268                         goto err_no_initvals;
2269                 break;
2270         case B43_PHYTYPE_LP:
2271                 if (rev == 13)
2272                         filename = "lp0initvals13";
2273                 else if (rev == 14)
2274                         filename = "lp0initvals14";
2275                 else if (rev >= 15)
2276                         filename = "lp0initvals15";
2277                 else
2278                         goto err_no_initvals;
2279                 break;
2280         case B43_PHYTYPE_HT:
2281                 if (rev == 29)
2282                         filename = "ht0initvals29";
2283                 else
2284                         goto err_no_initvals;
2285                 break;
2286         case B43_PHYTYPE_LCN:
2287                 if (rev == 24)
2288                         filename = "lcn0initvals24";
2289                 else
2290                         goto err_no_initvals;
2291                 break;
2292         default:
2293                 goto err_no_initvals;
2294         }
2295         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2296         if (err)
2297                 goto err_load;
2298
2299         /* Get bandswitch initvals */
2300         switch (dev->phy.type) {
2301         case B43_PHYTYPE_A:
2302                 if ((rev >= 5) && (rev <= 10)) {
2303                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2304                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2305                                 filename = "a0g1bsinitvals5";
2306                         else
2307                                 filename = "a0g0bsinitvals5";
2308                 } else if (rev >= 11)
2309                         filename = NULL;
2310                 else
2311                         goto err_no_initvals;
2312                 break;
2313         case B43_PHYTYPE_G:
2314                 if ((rev >= 5) && (rev <= 10))
2315                         filename = "b0g0bsinitvals5";
2316                 else if (rev >= 11)
2317                         filename = NULL;
2318                 else
2319                         goto err_no_initvals;
2320                 break;
2321         case B43_PHYTYPE_N:
2322                 if (rev >= 16)
2323                         filename = "n0bsinitvals16";
2324                 else if ((rev >= 11) && (rev <= 12))
2325                         filename = "n0bsinitvals11";
2326                 else
2327                         goto err_no_initvals;
2328                 break;
2329         case B43_PHYTYPE_LP:
2330                 if (rev == 13)
2331                         filename = "lp0bsinitvals13";
2332                 else if (rev == 14)
2333                         filename = "lp0bsinitvals14";
2334                 else if (rev >= 15)
2335                         filename = "lp0bsinitvals15";
2336                 else
2337                         goto err_no_initvals;
2338                 break;
2339         case B43_PHYTYPE_HT:
2340                 if (rev == 29)
2341                         filename = "ht0bsinitvals29";
2342                 else
2343                         goto err_no_initvals;
2344                 break;
2345         case B43_PHYTYPE_LCN:
2346                 if (rev == 24)
2347                         filename = "lcn0bsinitvals24";
2348                 else
2349                         goto err_no_initvals;
2350                 break;
2351         default:
2352                 goto err_no_initvals;
2353         }
2354         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2355         if (err)
2356                 goto err_load;
2357
2358         return 0;
2359
2360 err_no_ucode:
2361         err = ctx->fatal_failure = -EOPNOTSUPP;
2362         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2363                "is required for your device (wl-core rev %u)\n", rev);
2364         goto error;
2365
2366 err_no_pcm:
2367         err = ctx->fatal_failure = -EOPNOTSUPP;
2368         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2369                "is required for your device (wl-core rev %u)\n", rev);
2370         goto error;
2371
2372 err_no_initvals:
2373         err = ctx->fatal_failure = -EOPNOTSUPP;
2374         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2375                "is required for your device (wl-core rev %u)\n", rev);
2376         goto error;
2377
2378 err_load:
2379         /* We failed to load this firmware image. The error message
2380          * already is in ctx->errors. Return and let our caller decide
2381          * what to do. */
2382         goto error;
2383
2384 error:
2385         b43_release_firmware(dev);
2386         return err;
2387 }
2388
2389 static int b43_request_firmware(struct b43_wldev *dev)
2390 {
2391         struct b43_request_fw_context *ctx;
2392         unsigned int i;
2393         int err;
2394         const char *errmsg;
2395
2396         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2397         if (!ctx)
2398                 return -ENOMEM;
2399         ctx->dev = dev;
2400
2401         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2402         err = b43_try_request_fw(ctx);
2403         if (!err)
2404                 goto out; /* Successfully loaded it. */
2405         err = ctx->fatal_failure;
2406         if (err)
2407                 goto out;
2408
2409         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2410         err = b43_try_request_fw(ctx);
2411         if (!err)
2412                 goto out; /* Successfully loaded it. */
2413         err = ctx->fatal_failure;
2414         if (err)
2415                 goto out;
2416
2417         /* Could not find a usable firmware. Print the errors. */
2418         for (i = 0; i < B43_NR_FWTYPES; i++) {
2419                 errmsg = ctx->errors[i];
2420                 if (strlen(errmsg))
2421                         b43err(dev->wl, errmsg);
2422         }
2423         b43_print_fw_helptext(dev->wl, 1);
2424         err = -ENOENT;
2425
2426 out:
2427         kfree(ctx);
2428         return err;
2429 }
2430
2431 static int b43_upload_microcode(struct b43_wldev *dev)
2432 {
2433         struct wiphy *wiphy = dev->wl->hw->wiphy;
2434         const size_t hdr_len = sizeof(struct b43_fw_header);
2435         const __be32 *data;
2436         unsigned int i, len;
2437         u16 fwrev, fwpatch, fwdate, fwtime;
2438         u32 tmp, macctl;
2439         int err = 0;
2440
2441         /* Jump the microcode PSM to offset 0 */
2442         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2443         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2444         macctl |= B43_MACCTL_PSM_JMP0;
2445         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2446         /* Zero out all microcode PSM registers and shared memory. */
2447         for (i = 0; i < 64; i++)
2448                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2449         for (i = 0; i < 4096; i += 2)
2450                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2451
2452         /* Upload Microcode. */
2453         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2454         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2455         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2456         for (i = 0; i < len; i++) {
2457                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2458                 udelay(10);
2459         }
2460
2461         if (dev->fw.pcm.data) {
2462                 /* Upload PCM data. */
2463                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2464                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2465                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2466                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2467                 /* No need for autoinc bit in SHM_HW */
2468                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2469                 for (i = 0; i < len; i++) {
2470                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2471                         udelay(10);
2472                 }
2473         }
2474
2475         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2476
2477         /* Start the microcode PSM */
2478         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2479         macctl &= ~B43_MACCTL_PSM_JMP0;
2480         macctl |= B43_MACCTL_PSM_RUN;
2481         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2482
2483         /* Wait for the microcode to load and respond */
2484         i = 0;
2485         while (1) {
2486                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2487                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2488                         break;
2489                 i++;
2490                 if (i >= 20) {
2491                         b43err(dev->wl, "Microcode not responding\n");
2492                         b43_print_fw_helptext(dev->wl, 1);
2493                         err = -ENODEV;
2494                         goto error;
2495                 }
2496                 msleep(50);
2497         }
2498         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2499
2500         /* Get and check the revisions. */
2501         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2502         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2503         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2504         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2505
2506         if (fwrev <= 0x128) {
2507                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2508                        "binary drivers older than version 4.x is unsupported. "
2509                        "You must upgrade your firmware files.\n");
2510                 b43_print_fw_helptext(dev->wl, 1);
2511                 err = -EOPNOTSUPP;
2512                 goto error;
2513         }
2514         dev->fw.rev = fwrev;
2515         dev->fw.patch = fwpatch;
2516         if (dev->fw.rev >= 598)
2517                 dev->fw.hdr_format = B43_FW_HDR_598;
2518         else if (dev->fw.rev >= 410)
2519                 dev->fw.hdr_format = B43_FW_HDR_410;
2520         else
2521                 dev->fw.hdr_format = B43_FW_HDR_351;
2522         dev->fw.opensource = (fwdate == 0xFFFF);
2523
2524         /* Default to use-all-queues. */
2525         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2526         dev->qos_enabled = !!modparam_qos;
2527         /* Default to firmware/hardware crypto acceleration. */
2528         dev->hwcrypto_enabled = 1;
2529
2530         if (dev->fw.opensource) {
2531                 u16 fwcapa;
2532
2533                 /* Patchlevel info is encoded in the "time" field. */
2534                 dev->fw.patch = fwtime;
2535                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2536                         dev->fw.rev, dev->fw.patch);
2537
2538                 fwcapa = b43_fwcapa_read(dev);
2539                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2540                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2541                         /* Disable hardware crypto and fall back to software crypto. */
2542                         dev->hwcrypto_enabled = 0;
2543                 }
2544                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2545                         b43info(dev->wl, "QoS not supported by firmware\n");
2546                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2547                          * ieee80211_unregister to make sure the networking core can
2548                          * properly free possible resources. */
2549                         dev->wl->hw->queues = 1;
2550                         dev->qos_enabled = 0;
2551                 }
2552         } else {
2553                 b43info(dev->wl, "Loading firmware version %u.%u "
2554                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2555                         fwrev, fwpatch,
2556                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2557                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2558                 if (dev->fw.pcm_request_failed) {
2559                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2560                                 "Hardware accelerated cryptography is disabled.\n");
2561                         b43_print_fw_helptext(dev->wl, 0);
2562                 }
2563         }
2564
2565         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2566                         dev->fw.rev, dev->fw.patch);
2567         wiphy->hw_version = dev->dev->core_id;
2568
2569         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2570                 /* We're over the deadline, but we keep support for old fw
2571                  * until it turns out to be in major conflict with something new. */
2572                 b43warn(dev->wl, "You are using an old firmware image. "
2573                         "Support for old firmware will be removed soon "
2574                         "(official deadline was July 2008).\n");
2575                 b43_print_fw_helptext(dev->wl, 0);
2576         }
2577
2578         return 0;
2579
2580 error:
2581         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2582         macctl &= ~B43_MACCTL_PSM_RUN;
2583         macctl |= B43_MACCTL_PSM_JMP0;
2584         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2585
2586         return err;
2587 }
2588
2589 static int b43_write_initvals(struct b43_wldev *dev,
2590                               const struct b43_iv *ivals,
2591                               size_t count,
2592                               size_t array_size)
2593 {
2594         const struct b43_iv *iv;
2595         u16 offset;
2596         size_t i;
2597         bool bit32;
2598
2599         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2600         iv = ivals;
2601         for (i = 0; i < count; i++) {
2602                 if (array_size < sizeof(iv->offset_size))
2603                         goto err_format;
2604                 array_size -= sizeof(iv->offset_size);
2605                 offset = be16_to_cpu(iv->offset_size);
2606                 bit32 = !!(offset & B43_IV_32BIT);
2607                 offset &= B43_IV_OFFSET_MASK;
2608                 if (offset >= 0x1000)
2609                         goto err_format;
2610                 if (bit32) {
2611                         u32 value;
2612
2613                         if (array_size < sizeof(iv->data.d32))
2614                                 goto err_format;
2615                         array_size -= sizeof(iv->data.d32);
2616
2617                         value = get_unaligned_be32(&iv->data.d32);
2618                         b43_write32(dev, offset, value);
2619
2620                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2621                                                         sizeof(__be16) +
2622                                                         sizeof(__be32));
2623                 } else {
2624                         u16 value;
2625
2626                         if (array_size < sizeof(iv->data.d16))
2627                                 goto err_format;
2628                         array_size -= sizeof(iv->data.d16);
2629
2630                         value = be16_to_cpu(iv->data.d16);
2631                         b43_write16(dev, offset, value);
2632
2633                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2634                                                         sizeof(__be16) +
2635                                                         sizeof(__be16));
2636                 }
2637         }
2638         if (array_size)
2639                 goto err_format;
2640
2641         return 0;
2642
2643 err_format:
2644         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2645         b43_print_fw_helptext(dev->wl, 1);
2646
2647         return -EPROTO;
2648 }
2649
2650 static int b43_upload_initvals(struct b43_wldev *dev)
2651 {
2652         const size_t hdr_len = sizeof(struct b43_fw_header);
2653         const struct b43_fw_header *hdr;
2654         struct b43_firmware *fw = &dev->fw;
2655         const struct b43_iv *ivals;
2656         size_t count;
2657         int err;
2658
2659         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2660         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2661         count = be32_to_cpu(hdr->size);
2662         err = b43_write_initvals(dev, ivals, count,
2663                                  fw->initvals.data->size - hdr_len);
2664         if (err)
2665                 goto out;
2666         if (fw->initvals_band.data) {
2667                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2668                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2669                 count = be32_to_cpu(hdr->size);
2670                 err = b43_write_initvals(dev, ivals, count,
2671                                          fw->initvals_band.data->size - hdr_len);
2672                 if (err)
2673                         goto out;
2674         }
2675 out:
2676
2677         return err;
2678 }
2679
2680 /* Initialize the GPIOs
2681  * http://bcm-specs.sipsolutions.net/GPIO
2682  */
2683 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2684 {
2685         struct ssb_bus *bus = dev->dev->sdev->bus;
2686
2687 #ifdef CONFIG_SSB_DRIVER_PCICORE
2688         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2689 #else
2690         return bus->chipco.dev;
2691 #endif
2692 }
2693
2694 static int b43_gpio_init(struct b43_wldev *dev)
2695 {
2696         struct ssb_device *gpiodev;
2697         u32 mask, set;
2698
2699         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2700                     & ~B43_MACCTL_GPOUTSMSK);
2701
2702         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2703                     | 0x000F);
2704
2705         mask = 0x0000001F;
2706         set = 0x0000000F;
2707         if (dev->dev->chip_id == 0x4301) {
2708                 mask |= 0x0060;
2709                 set |= 0x0060;
2710         }
2711         if (0 /* FIXME: conditional unknown */ ) {
2712                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2713                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2714                             | 0x0100);
2715                 mask |= 0x0180;
2716                 set |= 0x0180;
2717         }
2718         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2719                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2720                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2721                             | 0x0200);
2722                 mask |= 0x0200;
2723                 set |= 0x0200;
2724         }
2725         if (dev->dev->core_rev >= 2)
2726                 mask |= 0x0010; /* FIXME: This is redundant. */
2727
2728         switch (dev->dev->bus_type) {
2729 #ifdef CONFIG_B43_BCMA
2730         case B43_BUS_BCMA:
2731                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2732                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2733                                         BCMA_CC_GPIOCTL) & mask) | set);
2734                 break;
2735 #endif
2736 #ifdef CONFIG_B43_SSB
2737         case B43_BUS_SSB:
2738                 gpiodev = b43_ssb_gpio_dev(dev);
2739                 if (gpiodev)
2740                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2741                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2742                                     & mask) | set);
2743                 break;
2744 #endif
2745         }
2746
2747         return 0;
2748 }
2749
2750 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2751 static void b43_gpio_cleanup(struct b43_wldev *dev)
2752 {
2753         struct ssb_device *gpiodev;
2754
2755         switch (dev->dev->bus_type) {
2756 #ifdef CONFIG_B43_BCMA
2757         case B43_BUS_BCMA:
2758                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2759                                 0);
2760                 break;
2761 #endif
2762 #ifdef CONFIG_B43_SSB
2763         case B43_BUS_SSB:
2764                 gpiodev = b43_ssb_gpio_dev(dev);
2765                 if (gpiodev)
2766                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2767                 break;
2768 #endif
2769         }
2770 }
2771
2772 /* http://bcm-specs.sipsolutions.net/EnableMac */
2773 void b43_mac_enable(struct b43_wldev *dev)
2774 {
2775         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2776                 u16 fwstate;
2777
2778                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2779                                          B43_SHM_SH_UCODESTAT);
2780                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2781                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2782                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2783                                "should be suspended, but current state is %u\n",
2784                                fwstate);
2785                 }
2786         }
2787
2788         dev->mac_suspended--;
2789         B43_WARN_ON(dev->mac_suspended < 0);
2790         if (dev->mac_suspended == 0) {
2791                 b43_write32(dev, B43_MMIO_MACCTL,
2792                             b43_read32(dev, B43_MMIO_MACCTL)
2793                             | B43_MACCTL_ENABLED);
2794                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2795                             B43_IRQ_MAC_SUSPENDED);
2796                 /* Commit writes */
2797                 b43_read32(dev, B43_MMIO_MACCTL);
2798                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2799                 b43_power_saving_ctl_bits(dev, 0);
2800         }
2801 }
2802
2803 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2804 void b43_mac_suspend(struct b43_wldev *dev)
2805 {
2806         int i;
2807         u32 tmp;
2808
2809         might_sleep();
2810         B43_WARN_ON(dev->mac_suspended < 0);
2811
2812         if (dev->mac_suspended == 0) {
2813                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2814                 b43_write32(dev, B43_MMIO_MACCTL,
2815                             b43_read32(dev, B43_MMIO_MACCTL)
2816                             & ~B43_MACCTL_ENABLED);
2817                 /* force pci to flush the write */
2818                 b43_read32(dev, B43_MMIO_MACCTL);
2819                 for (i = 35; i; i--) {
2820                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2821                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2822                                 goto out;
2823                         udelay(10);
2824                 }
2825                 /* Hm, it seems this will take some time. Use msleep(). */
2826                 for (i = 40; i; i--) {
2827                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2828                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2829                                 goto out;
2830                         msleep(1);
2831                 }
2832                 b43err(dev->wl, "MAC suspend failed\n");
2833         }
2834 out:
2835         dev->mac_suspended++;
2836 }
2837
2838 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2839 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2840 {
2841         u32 tmp;
2842
2843         switch (dev->dev->bus_type) {
2844 #ifdef CONFIG_B43_BCMA
2845         case B43_BUS_BCMA:
2846                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2847                 if (on)
2848                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2849                 else
2850                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2851                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2852                 break;
2853 #endif
2854 #ifdef CONFIG_B43_SSB
2855         case B43_BUS_SSB:
2856                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2857                 if (on)
2858                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2859                 else
2860                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2861                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2862                 break;
2863 #endif
2864         }
2865 }
2866
2867 static void b43_adjust_opmode(struct b43_wldev *dev)
2868 {
2869         struct b43_wl *wl = dev->wl;
2870         u32 ctl;
2871         u16 cfp_pretbtt;
2872
2873         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2874         /* Reset status to STA infrastructure mode. */
2875         ctl &= ~B43_MACCTL_AP;
2876         ctl &= ~B43_MACCTL_KEEP_CTL;
2877         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2878         ctl &= ~B43_MACCTL_KEEP_BAD;
2879         ctl &= ~B43_MACCTL_PROMISC;
2880         ctl &= ~B43_MACCTL_BEACPROMISC;
2881         ctl |= B43_MACCTL_INFRA;
2882
2883         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2884             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2885                 ctl |= B43_MACCTL_AP;
2886         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2887                 ctl &= ~B43_MACCTL_INFRA;
2888
2889         if (wl->filter_flags & FIF_CONTROL)
2890                 ctl |= B43_MACCTL_KEEP_CTL;
2891         if (wl->filter_flags & FIF_FCSFAIL)
2892                 ctl |= B43_MACCTL_KEEP_BAD;
2893         if (wl->filter_flags & FIF_PLCPFAIL)
2894                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2895         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2896                 ctl |= B43_MACCTL_PROMISC;
2897         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2898                 ctl |= B43_MACCTL_BEACPROMISC;
2899
2900         /* Workaround: On old hardware the HW-MAC-address-filter
2901          * doesn't work properly, so always run promisc in filter
2902          * it in software. */
2903         if (dev->dev->core_rev <= 4)
2904                 ctl |= B43_MACCTL_PROMISC;
2905
2906         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2907
2908         cfp_pretbtt = 2;
2909         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2910                 if (dev->dev->chip_id == 0x4306 &&
2911                     dev->dev->chip_rev == 3)
2912                         cfp_pretbtt = 100;
2913                 else
2914                         cfp_pretbtt = 50;
2915         }
2916         b43_write16(dev, 0x612, cfp_pretbtt);
2917
2918         /* FIXME: We don't currently implement the PMQ mechanism,
2919          *        so always disable it. If we want to implement PMQ,
2920          *        we need to enable it here (clear DISCPMQ) in AP mode.
2921          */
2922         if (0  /* ctl & B43_MACCTL_AP */) {
2923                 b43_write32(dev, B43_MMIO_MACCTL,
2924                             b43_read32(dev, B43_MMIO_MACCTL)
2925                             & ~B43_MACCTL_DISCPMQ);
2926         } else {
2927                 b43_write32(dev, B43_MMIO_MACCTL,
2928                             b43_read32(dev, B43_MMIO_MACCTL)
2929                             | B43_MACCTL_DISCPMQ);
2930         }
2931 }
2932
2933 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2934 {
2935         u16 offset;
2936
2937         if (is_ofdm) {
2938                 offset = 0x480;
2939                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2940         } else {
2941                 offset = 0x4C0;
2942                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2943         }
2944         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2945                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2946 }
2947
2948 static void b43_rate_memory_init(struct b43_wldev *dev)
2949 {
2950         switch (dev->phy.type) {
2951         case B43_PHYTYPE_A:
2952         case B43_PHYTYPE_G:
2953         case B43_PHYTYPE_N:
2954         case B43_PHYTYPE_LP:
2955         case B43_PHYTYPE_HT:
2956                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2957                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2958                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2959                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2960                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2961                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2962                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2963                 if (dev->phy.type == B43_PHYTYPE_A)
2964                         break;
2965                 /* fallthrough */
2966         case B43_PHYTYPE_B:
2967                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2968                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2969                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2970                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2971                 break;
2972         default:
2973                 B43_WARN_ON(1);
2974         }
2975 }
2976
2977 /* Set the default values for the PHY TX Control Words. */
2978 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2979 {
2980         u16 ctl = 0;
2981
2982         ctl |= B43_TXH_PHY_ENC_CCK;
2983         ctl |= B43_TXH_PHY_ANT01AUTO;
2984         ctl |= B43_TXH_PHY_TXPWR;
2985
2986         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2987         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2988         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2989 }
2990
2991 /* Set the TX-Antenna for management frames sent by firmware. */
2992 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2993 {
2994         u16 ant;
2995         u16 tmp;
2996
2997         ant = b43_antenna_to_phyctl(antenna);
2998
2999         /* For ACK/CTS */
3000         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3001         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3002         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3003         /* For Probe Resposes */
3004         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3005         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3006         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3007 }
3008
3009 /* This is the opposite of b43_chip_init() */
3010 static void b43_chip_exit(struct b43_wldev *dev)
3011 {
3012         b43_phy_exit(dev);
3013         b43_gpio_cleanup(dev);
3014         /* firmware is released later */
3015 }
3016
3017 /* Initialize the chip
3018  * http://bcm-specs.sipsolutions.net/ChipInit
3019  */
3020 static int b43_chip_init(struct b43_wldev *dev)
3021 {
3022         struct b43_phy *phy = &dev->phy;
3023         int err;
3024         u32 macctl;
3025         u16 value16;
3026
3027         /* Initialize the MAC control */
3028         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3029         if (dev->phy.gmode)
3030                 macctl |= B43_MACCTL_GMODE;
3031         macctl |= B43_MACCTL_INFRA;
3032         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3033
3034         err = b43_request_firmware(dev);
3035         if (err)
3036                 goto out;
3037         err = b43_upload_microcode(dev);
3038         if (err)
3039                 goto out;       /* firmware is released later */
3040
3041         err = b43_gpio_init(dev);
3042         if (err)
3043                 goto out;       /* firmware is released later */
3044
3045         err = b43_upload_initvals(dev);
3046         if (err)
3047                 goto err_gpio_clean;
3048
3049         /* Turn the Analog on and initialize the PHY. */
3050         phy->ops->switch_analog(dev, 1);
3051         err = b43_phy_init(dev);
3052         if (err)
3053                 goto err_gpio_clean;
3054
3055         /* Disable Interference Mitigation. */
3056         if (phy->ops->interf_mitigation)
3057                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3058
3059         /* Select the antennae */
3060         if (phy->ops->set_rx_antenna)
3061                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3062         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3063
3064         if (phy->type == B43_PHYTYPE_B) {
3065                 value16 = b43_read16(dev, 0x005E);
3066                 value16 |= 0x0004;
3067                 b43_write16(dev, 0x005E, value16);
3068         }
3069         b43_write32(dev, 0x0100, 0x01000000);
3070         if (dev->dev->core_rev < 5)
3071                 b43_write32(dev, 0x010C, 0x01000000);
3072
3073         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3074                     & ~B43_MACCTL_INFRA);
3075         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3076                     | B43_MACCTL_INFRA);
3077
3078         /* Probe Response Timeout value */
3079         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3080         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3081
3082         /* Initially set the wireless operation mode. */
3083         b43_adjust_opmode(dev);
3084
3085         if (dev->dev->core_rev < 3) {
3086                 b43_write16(dev, 0x060E, 0x0000);
3087                 b43_write16(dev, 0x0610, 0x8000);
3088                 b43_write16(dev, 0x0604, 0x0000);
3089                 b43_write16(dev, 0x0606, 0x0200);
3090         } else {
3091                 b43_write32(dev, 0x0188, 0x80000000);
3092                 b43_write32(dev, 0x018C, 0x02000000);
3093         }
3094         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3095         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3096         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3097         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3098         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3099         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3100         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3101
3102         b43_mac_phy_clock_set(dev, true);
3103
3104         switch (dev->dev->bus_type) {
3105 #ifdef CONFIG_B43_BCMA
3106         case B43_BUS_BCMA:
3107                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3108                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3109                 break;
3110 #endif
3111 #ifdef CONFIG_B43_SSB
3112         case B43_BUS_SSB:
3113                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3114                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3115                 break;
3116 #endif
3117         }
3118
3119         err = 0;
3120         b43dbg(dev->wl, "Chip initialized\n");
3121 out:
3122         return err;
3123
3124 err_gpio_clean:
3125         b43_gpio_cleanup(dev);
3126         return err;
3127 }
3128
3129 static void b43_periodic_every60sec(struct b43_wldev *dev)
3130 {
3131         const struct b43_phy_operations *ops = dev->phy.ops;
3132
3133         if (ops->pwork_60sec)
3134                 ops->pwork_60sec(dev);
3135
3136         /* Force check the TX power emission now. */
3137         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3138 }
3139
3140 static void b43_periodic_every30sec(struct b43_wldev *dev)
3141 {
3142         /* Update device statistics. */
3143         b43_calculate_link_quality(dev);
3144 }
3145
3146 static void b43_periodic_every15sec(struct b43_wldev *dev)
3147 {
3148         struct b43_phy *phy = &dev->phy;
3149         u16 wdr;
3150
3151         if (dev->fw.opensource) {
3152                 /* Check if the firmware is still alive.
3153                  * It will reset the watchdog counter to 0 in its idle loop. */
3154                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3155                 if (unlikely(wdr)) {
3156                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3157                         b43_controller_restart(dev, "Firmware watchdog");
3158                         return;
3159                 } else {
3160                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3161                                         B43_WATCHDOG_REG, 1);
3162                 }
3163         }
3164
3165         if (phy->ops->pwork_15sec)
3166                 phy->ops->pwork_15sec(dev);
3167
3168         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3169         wmb();
3170
3171 #if B43_DEBUG
3172         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3173                 unsigned int i;
3174
3175                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3176                        dev->irq_count / 15,
3177                        dev->tx_count / 15,
3178                        dev->rx_count / 15);
3179                 dev->irq_count = 0;
3180                 dev->tx_count = 0;
3181                 dev->rx_count = 0;
3182                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3183                         if (dev->irq_bit_count[i]) {
3184                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3185                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3186                                 dev->irq_bit_count[i] = 0;
3187                         }
3188                 }
3189         }
3190 #endif
3191 }
3192
3193 static void do_periodic_work(struct b43_wldev *dev)
3194 {
3195         unsigned int state;
3196
3197         state = dev->periodic_state;
3198         if (state % 4 == 0)
3199                 b43_periodic_every60sec(dev);
3200         if (state % 2 == 0)
3201                 b43_periodic_every30sec(dev);
3202         b43_periodic_every15sec(dev);
3203 }
3204
3205 /* Periodic work locking policy:
3206  *      The whole periodic work handler is protected by
3207  *      wl->mutex. If another lock is needed somewhere in the
3208  *      pwork callchain, it's acquired in-place, where it's needed.
3209  */
3210 static void b43_periodic_work_handler(struct work_struct *work)
3211 {
3212         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3213                                              periodic_work.work);
3214         struct b43_wl *wl = dev->wl;
3215         unsigned long delay;
3216
3217         mutex_lock(&wl->mutex);
3218
3219         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3220                 goto out;
3221         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3222                 goto out_requeue;
3223
3224         do_periodic_work(dev);
3225
3226         dev->periodic_state++;
3227 out_requeue:
3228         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3229                 delay = msecs_to_jiffies(50);
3230         else
3231                 delay = round_jiffies_relative(HZ * 15);
3232         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3233 out:
3234         mutex_unlock(&wl->mutex);
3235 }
3236
3237 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3238 {
3239         struct delayed_work *work = &dev->periodic_work;
3240
3241         dev->periodic_state = 0;
3242         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3243         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3244 }
3245
3246 /* Check if communication with the device works correctly. */
3247 static int b43_validate_chipaccess(struct b43_wldev *dev)
3248 {
3249         u32 v, backup0, backup4;
3250
3251         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3252         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3253
3254         /* Check for read/write and endianness problems. */
3255         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3256         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3257                 goto error;
3258         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3259         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3260                 goto error;
3261
3262         /* Check if unaligned 32bit SHM_SHARED access works properly.
3263          * However, don't bail out on failure, because it's noncritical. */
3264         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3265         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3266         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3267         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3268         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3269                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3270         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3271         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3272             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3273             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3274             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3275                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3276
3277         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3278         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3279
3280         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3281                 /* The 32bit register shadows the two 16bit registers
3282                  * with update sideeffects. Validate this. */
3283                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3284                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3285                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3286                         goto error;
3287                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3288                         goto error;
3289         }
3290         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3291
3292         v = b43_read32(dev, B43_MMIO_MACCTL);
3293         v |= B43_MACCTL_GMODE;
3294         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3295                 goto error;
3296
3297         return 0;
3298 error:
3299         b43err(dev->wl, "Failed to validate the chipaccess\n");
3300         return -ENODEV;
3301 }
3302
3303 static void b43_security_init(struct b43_wldev *dev)
3304 {
3305         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3306         /* KTP is a word address, but we address SHM bytewise.
3307          * So multiply by two.
3308          */
3309         dev->ktp *= 2;
3310         /* Number of RCMTA address slots */
3311         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3312         /* Clear the key memory. */
3313         b43_clear_keys(dev);
3314 }
3315
3316 #ifdef CONFIG_B43_HWRNG
3317 static int b43_rng_read(struct hwrng *rng, u32 *data)
3318 {
3319         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3320         struct b43_wldev *dev;
3321         int count = -ENODEV;
3322
3323         mutex_lock(&wl->mutex);
3324         dev = wl->current_dev;
3325         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3326                 *data = b43_read16(dev, B43_MMIO_RNG);
3327                 count = sizeof(u16);
3328         }
3329         mutex_unlock(&wl->mutex);
3330
3331         return count;
3332 }
3333 #endif /* CONFIG_B43_HWRNG */
3334
3335 static void b43_rng_exit(struct b43_wl *wl)
3336 {
3337 #ifdef CONFIG_B43_HWRNG
3338         if (wl->rng_initialized)
3339                 hwrng_unregister(&wl->rng);
3340 #endif /* CONFIG_B43_HWRNG */
3341 }
3342
3343 static int b43_rng_init(struct b43_wl *wl)
3344 {
3345         int err = 0;
3346
3347 #ifdef CONFIG_B43_HWRNG
3348         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3349                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3350         wl->rng.name = wl->rng_name;
3351         wl->rng.data_read = b43_rng_read;
3352         wl->rng.priv = (unsigned long)wl;
3353         wl->rng_initialized = 1;
3354         err = hwrng_register(&wl->rng);
3355         if (err) {
3356                 wl->rng_initialized = 0;
3357                 b43err(wl, "Failed to register the random "
3358                        "number generator (%d)\n", err);
3359         }
3360 #endif /* CONFIG_B43_HWRNG */
3361
3362         return err;
3363 }
3364
3365 static void b43_tx_work(struct work_struct *work)
3366 {
3367         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3368         struct b43_wldev *dev;
3369         struct sk_buff *skb;
3370         int err = 0;
3371
3372         mutex_lock(&wl->mutex);
3373         dev = wl->current_dev;
3374         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3375                 mutex_unlock(&wl->mutex);
3376                 return;
3377         }
3378
3379         while (skb_queue_len(&wl->tx_queue)) {
3380                 skb = skb_dequeue(&wl->tx_queue);
3381
3382                 if (b43_using_pio_transfers(dev))
3383                         err = b43_pio_tx(dev, skb);
3384                 else
3385                         err = b43_dma_tx(dev, skb);
3386                 if (unlikely(err))
3387                         dev_kfree_skb(skb); /* Drop it */
3388         }
3389
3390 #if B43_DEBUG
3391         dev->tx_count++;
3392 #endif
3393         mutex_unlock(&wl->mutex);
3394 }
3395
3396 static void b43_op_tx(struct ieee80211_hw *hw,
3397                      struct sk_buff *skb)
3398 {
3399         struct b43_wl *wl = hw_to_b43_wl(hw);
3400
3401         if (unlikely(skb->len < 2 + 2 + 6)) {
3402                 /* Too short, this can't be a valid frame. */
3403                 dev_kfree_skb_any(skb);
3404                 return;
3405         }
3406         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3407
3408         skb_queue_tail(&wl->tx_queue, skb);
3409         ieee80211_queue_work(wl->hw, &wl->tx_work);
3410 }
3411
3412 static void b43_qos_params_upload(struct b43_wldev *dev,
3413                                   const struct ieee80211_tx_queue_params *p,
3414                                   u16 shm_offset)
3415 {
3416         u16 params[B43_NR_QOSPARAMS];
3417         int bslots, tmp;
3418         unsigned int i;
3419
3420         if (!dev->qos_enabled)
3421                 return;
3422
3423         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3424
3425         memset(&params, 0, sizeof(params));
3426
3427         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3428         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3429         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3430         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3431         params[B43_QOSPARAM_AIFS] = p->aifs;
3432         params[B43_QOSPARAM_BSLOTS] = bslots;
3433         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3434
3435         for (i = 0; i < ARRAY_SIZE(params); i++) {
3436                 if (i == B43_QOSPARAM_STATUS) {
3437                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3438                                              shm_offset + (i * 2));
3439                         /* Mark the parameters as updated. */
3440                         tmp |= 0x100;
3441                         b43_shm_write16(dev, B43_SHM_SHARED,
3442                                         shm_offset + (i * 2),
3443                                         tmp);
3444                 } else {
3445                         b43_shm_write16(dev, B43_SHM_SHARED,
3446                                         shm_offset + (i * 2),
3447                                         params[i]);
3448                 }
3449         }
3450 }
3451
3452 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3453 static const u16 b43_qos_shm_offsets[] = {
3454         /* [mac80211-queue-nr] = SHM_OFFSET, */
3455         [0] = B43_QOS_VOICE,
3456         [1] = B43_QOS_VIDEO,
3457         [2] = B43_QOS_BESTEFFORT,
3458         [3] = B43_QOS_BACKGROUND,
3459 };
3460
3461 /* Update all QOS parameters in hardware. */
3462 static void b43_qos_upload_all(struct b43_wldev *dev)
3463 {
3464         struct b43_wl *wl = dev->wl;
3465         struct b43_qos_params *params;
3466         unsigned int i;
3467
3468         if (!dev->qos_enabled)
3469                 return;
3470
3471         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3472                      ARRAY_SIZE(wl->qos_params));
3473
3474         b43_mac_suspend(dev);
3475         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3476                 params = &(wl->qos_params[i]);
3477                 b43_qos_params_upload(dev, &(params->p),
3478                                       b43_qos_shm_offsets[i]);
3479         }
3480         b43_mac_enable(dev);
3481 }
3482
3483 static void b43_qos_clear(struct b43_wl *wl)
3484 {
3485         struct b43_qos_params *params;
3486         unsigned int i;
3487
3488         /* Initialize QoS parameters to sane defaults. */
3489
3490         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3491                      ARRAY_SIZE(wl->qos_params));
3492
3493         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3494                 params = &(wl->qos_params[i]);
3495
3496                 switch (b43_qos_shm_offsets[i]) {
3497                 case B43_QOS_VOICE:
3498                         params->p.txop = 0;
3499                         params->p.aifs = 2;
3500                         params->p.cw_min = 0x0001;
3501                         params->p.cw_max = 0x0001;
3502                         break;
3503                 case B43_QOS_VIDEO:
3504                         params->p.txop = 0;
3505                         params->p.aifs = 2;
3506                         params->p.cw_min = 0x0001;
3507                         params->p.cw_max = 0x0001;
3508                         break;
3509                 case B43_QOS_BESTEFFORT:
3510                         params->p.txop = 0;
3511                         params->p.aifs = 3;
3512                         params->p.cw_min = 0x0001;
3513                         params->p.cw_max = 0x03FF;
3514                         break;
3515                 case B43_QOS_BACKGROUND:
3516                         params->p.txop = 0;
3517                         params->p.aifs = 7;
3518                         params->p.cw_min = 0x0001;
3519                         params->p.cw_max = 0x03FF;
3520                         break;
3521                 default:
3522                         B43_WARN_ON(1);
3523                 }
3524         }
3525 }
3526
3527 /* Initialize the core's QOS capabilities */
3528 static void b43_qos_init(struct b43_wldev *dev)
3529 {
3530         if (!dev->qos_enabled) {
3531                 /* Disable QOS support. */
3532                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3533                 b43_write16(dev, B43_MMIO_IFSCTL,
3534                             b43_read16(dev, B43_MMIO_IFSCTL)
3535                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3536                 b43dbg(dev->wl, "QoS disabled\n");
3537                 return;
3538         }
3539
3540         /* Upload the current QOS parameters. */
3541         b43_qos_upload_all(dev);
3542
3543         /* Enable QOS support. */
3544         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3545         b43_write16(dev, B43_MMIO_IFSCTL,
3546                     b43_read16(dev, B43_MMIO_IFSCTL)
3547                     | B43_MMIO_IFSCTL_USE_EDCF);
3548         b43dbg(dev->wl, "QoS enabled\n");
3549 }
3550
3551 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3552                           const struct ieee80211_tx_queue_params *params)
3553 {
3554         struct b43_wl *wl = hw_to_b43_wl(hw);
3555         struct b43_wldev *dev;
3556         unsigned int queue = (unsigned int)_queue;
3557         int err = -ENODEV;
3558
3559         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3560                 /* Queue not available or don't support setting
3561                  * params on this queue. Return success to not
3562                  * confuse mac80211. */
3563                 return 0;
3564         }
3565         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3566                      ARRAY_SIZE(wl->qos_params));
3567
3568         mutex_lock(&wl->mutex);
3569         dev = wl->current_dev;
3570         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3571                 goto out_unlock;
3572
3573         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3574         b43_mac_suspend(dev);
3575         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3576                               b43_qos_shm_offsets[queue]);
3577         b43_mac_enable(dev);
3578         err = 0;
3579
3580 out_unlock:
3581         mutex_unlock(&wl->mutex);
3582
3583         return err;
3584 }
3585
3586 static int b43_op_get_stats(struct ieee80211_hw *hw,
3587                             struct ieee80211_low_level_stats *stats)
3588 {
3589         struct b43_wl *wl = hw_to_b43_wl(hw);
3590
3591         mutex_lock(&wl->mutex);
3592         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3593         mutex_unlock(&wl->mutex);
3594
3595         return 0;
3596 }
3597
3598 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3599 {
3600         struct b43_wl *wl = hw_to_b43_wl(hw);
3601         struct b43_wldev *dev;
3602         u64 tsf;
3603
3604         mutex_lock(&wl->mutex);
3605         dev = wl->current_dev;
3606
3607         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3608                 b43_tsf_read(dev, &tsf);
3609         else
3610                 tsf = 0;
3611
3612         mutex_unlock(&wl->mutex);
3613
3614         return tsf;
3615 }
3616
3617 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3618 {
3619         struct b43_wl *wl = hw_to_b43_wl(hw);
3620         struct b43_wldev *dev;
3621
3622         mutex_lock(&wl->mutex);
3623         dev = wl->current_dev;
3624
3625         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3626                 b43_tsf_write(dev, tsf);
3627
3628         mutex_unlock(&wl->mutex);
3629 }
3630
3631 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3632 {
3633         u32 tmp;
3634
3635         switch (dev->dev->bus_type) {
3636 #ifdef CONFIG_B43_BCMA
3637         case B43_BUS_BCMA:
3638                 b43err(dev->wl,
3639                        "Putting PHY into reset not supported on BCMA\n");
3640                 break;
3641 #endif
3642 #ifdef CONFIG_B43_SSB
3643         case B43_BUS_SSB:
3644                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3645                 tmp &= ~B43_TMSLOW_GMODE;
3646                 tmp |= B43_TMSLOW_PHYRESET;
3647                 tmp |= SSB_TMSLOW_FGC;
3648                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3649                 msleep(1);
3650
3651                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3652                 tmp &= ~SSB_TMSLOW_FGC;
3653                 tmp |= B43_TMSLOW_PHYRESET;
3654                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3655                 msleep(1);
3656
3657                 break;
3658 #endif
3659         }
3660 }
3661
3662 static const char *band_to_string(enum ieee80211_band band)
3663 {
3664         switch (band) {
3665         case IEEE80211_BAND_5GHZ:
3666                 return "5";
3667         case IEEE80211_BAND_2GHZ:
3668                 return "2.4";
3669         default:
3670                 break;
3671         }
3672         B43_WARN_ON(1);
3673         return "";
3674 }
3675
3676 /* Expects wl->mutex locked */
3677 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3678 {
3679         struct b43_wldev *up_dev = NULL;
3680         struct b43_wldev *down_dev;
3681         struct b43_wldev *d;
3682         int err;
3683         bool uninitialized_var(gmode);
3684         int prev_status;
3685
3686         /* Find a device and PHY which supports the band. */
3687         list_for_each_entry(d, &wl->devlist, list) {
3688                 switch (chan->band) {
3689                 case IEEE80211_BAND_5GHZ:
3690                         if (d->phy.supports_5ghz) {
3691                                 up_dev = d;
3692                                 gmode = 0;
3693                         }
3694                         break;
3695                 case IEEE80211_BAND_2GHZ:
3696                         if (d->phy.supports_2ghz) {
3697                                 up_dev = d;
3698                                 gmode = 1;
3699                         }
3700                         break;
3701                 default:
3702                         B43_WARN_ON(1);
3703                         return -EINVAL;
3704                 }
3705                 if (up_dev)
3706                         break;
3707         }
3708         if (!up_dev) {
3709                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3710                        band_to_string(chan->band));
3711                 return -ENODEV;
3712         }
3713         if ((up_dev == wl->current_dev) &&
3714             (!!wl->current_dev->phy.gmode == !!gmode)) {
3715                 /* This device is already running. */
3716                 return 0;
3717         }
3718         b43dbg(wl, "Switching to %s-GHz band\n",
3719                band_to_string(chan->band));
3720         down_dev = wl->current_dev;
3721
3722         prev_status = b43_status(down_dev);
3723         /* Shutdown the currently running core. */
3724         if (prev_status >= B43_STAT_STARTED)
3725                 down_dev = b43_wireless_core_stop(down_dev);
3726         if (prev_status >= B43_STAT_INITIALIZED)
3727                 b43_wireless_core_exit(down_dev);
3728
3729         if (down_dev != up_dev) {
3730                 /* We switch to a different core, so we put PHY into
3731                  * RESET on the old core. */
3732                 b43_put_phy_into_reset(down_dev);
3733         }
3734
3735         /* Now start the new core. */
3736         up_dev->phy.gmode = gmode;
3737         if (prev_status >= B43_STAT_INITIALIZED) {
3738                 err = b43_wireless_core_init(up_dev);
3739                 if (err) {
3740                         b43err(wl, "Fatal: Could not initialize device for "
3741                                "selected %s-GHz band\n",
3742                                band_to_string(chan->band));
3743                         goto init_failure;
3744                 }
3745         }
3746         if (prev_status >= B43_STAT_STARTED) {
3747                 err = b43_wireless_core_start(up_dev);
3748                 if (err) {
3749                         b43err(wl, "Fatal: Coult not start device for "
3750                                "selected %s-GHz band\n",
3751                                band_to_string(chan->band));
3752                         b43_wireless_core_exit(up_dev);
3753                         goto init_failure;
3754                 }
3755         }
3756         B43_WARN_ON(b43_status(up_dev) != prev_status);
3757
3758         wl->current_dev = up_dev;
3759
3760         return 0;
3761 init_failure:
3762         /* Whoops, failed to init the new core. No core is operating now. */
3763         wl->current_dev = NULL;
3764         return err;
3765 }
3766
3767 /* Write the short and long frame retry limit values. */
3768 static void b43_set_retry_limits(struct b43_wldev *dev,
3769                                  unsigned int short_retry,
3770                                  unsigned int long_retry)
3771 {
3772         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3773          * the chip-internal counter. */
3774         short_retry = min(short_retry, (unsigned int)0xF);
3775         long_retry = min(long_retry, (unsigned int)0xF);
3776
3777         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3778                         short_retry);
3779         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3780                         long_retry);
3781 }
3782
3783 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3784 {
3785         struct b43_wl *wl = hw_to_b43_wl(hw);
3786         struct b43_wldev *dev;
3787         struct b43_phy *phy;
3788         struct ieee80211_conf *conf = &hw->conf;
3789         int antenna;
3790         int err = 0;
3791         bool reload_bss = false;
3792
3793         mutex_lock(&wl->mutex);
3794
3795         dev = wl->current_dev;
3796
3797         /* Switch the band (if necessary). This might change the active core. */
3798         err = b43_switch_band(wl, conf->channel);
3799         if (err)
3800                 goto out_unlock_mutex;
3801
3802         /* Need to reload all settings if the core changed */
3803         if (dev != wl->current_dev) {
3804                 dev = wl->current_dev;
3805                 changed = ~0;
3806                 reload_bss = true;
3807         }
3808
3809         phy = &dev->phy;
3810
3811         if (conf_is_ht(conf))
3812                 phy->is_40mhz =
3813                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3814         else
3815                 phy->is_40mhz = false;
3816
3817         b43_mac_suspend(dev);
3818
3819         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3820                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3821                                           conf->long_frame_max_tx_count);
3822         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3823         if (!changed)
3824                 goto out_mac_enable;
3825
3826         /* Switch to the requested channel.
3827          * The firmware takes care of races with the TX handler. */
3828         if (conf->channel->hw_value != phy->channel)
3829                 b43_switch_channel(dev, conf->channel->hw_value);
3830
3831         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3832
3833         /* Adjust the desired TX power level. */
3834         if (conf->power_level != 0) {
3835                 if (conf->power_level != phy->desired_txpower) {
3836                         phy->desired_txpower = conf->power_level;
3837                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3838                                                    B43_TXPWR_IGNORE_TSSI);
3839                 }
3840         }
3841
3842         /* Antennas for RX and management frame TX. */
3843         antenna = B43_ANTENNA_DEFAULT;
3844         b43_mgmtframe_txantenna(dev, antenna);
3845         antenna = B43_ANTENNA_DEFAULT;
3846         if (phy->ops->set_rx_antenna)
3847                 phy->ops->set_rx_antenna(dev, antenna);
3848
3849         if (wl->radio_enabled != phy->radio_on) {
3850                 if (wl->radio_enabled) {
3851                         b43_software_rfkill(dev, false);
3852                         b43info(dev->wl, "Radio turned on by software\n");
3853                         if (!dev->radio_hw_enable) {
3854                                 b43info(dev->wl, "The hardware RF-kill button "
3855                                         "still turns the radio physically off. "
3856                                         "Press the button to turn it on.\n");
3857                         }
3858                 } else {
3859                         b43_software_rfkill(dev, true);
3860                         b43info(dev->wl, "Radio turned off by software\n");
3861                 }
3862         }
3863
3864 out_mac_enable:
3865         b43_mac_enable(dev);
3866 out_unlock_mutex:
3867         mutex_unlock(&wl->mutex);
3868
3869         if (wl->vif && reload_bss)
3870                 b43_op_bss_info_changed(hw, wl->vif, &wl->vif->bss_conf, ~0);
3871
3872         return err;
3873 }
3874
3875 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3876 {
3877         struct ieee80211_supported_band *sband =
3878                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3879         struct ieee80211_rate *rate;
3880         int i;
3881         u16 basic, direct, offset, basic_offset, rateptr;
3882
3883         for (i = 0; i < sband->n_bitrates; i++) {
3884                 rate = &sband->bitrates[i];
3885
3886                 if (b43_is_cck_rate(rate->hw_value)) {
3887                         direct = B43_SHM_SH_CCKDIRECT;
3888                         basic = B43_SHM_SH_CCKBASIC;
3889                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3890                         offset &= 0xF;
3891                 } else {
3892                         direct = B43_SHM_SH_OFDMDIRECT;
3893                         basic = B43_SHM_SH_OFDMBASIC;
3894                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3895                         offset &= 0xF;
3896                 }
3897
3898                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3899
3900                 if (b43_is_cck_rate(rate->hw_value)) {
3901                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3902                         basic_offset &= 0xF;
3903                 } else {
3904                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3905                         basic_offset &= 0xF;
3906                 }
3907
3908                 /*
3909                  * Get the pointer that we need to point to
3910                  * from the direct map
3911                  */
3912                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3913                                          direct + 2 * basic_offset);
3914                 /* and write it to the basic map */
3915                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3916                                 rateptr);
3917         }
3918 }
3919
3920 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3921                                     struct ieee80211_vif *vif,
3922                                     struct ieee80211_bss_conf *conf,
3923                                     u32 changed)
3924 {
3925         struct b43_wl *wl = hw_to_b43_wl(hw);
3926         struct b43_wldev *dev;
3927
3928         mutex_lock(&wl->mutex);
3929
3930         dev = wl->current_dev;
3931         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3932                 goto out_unlock_mutex;
3933
3934         B43_WARN_ON(wl->vif != vif);
3935
3936         if (changed & BSS_CHANGED_BSSID) {
3937                 if (conf->bssid)
3938                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3939                 else
3940                         memset(wl->bssid, 0, ETH_ALEN);
3941         }
3942
3943         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3944                 if (changed & BSS_CHANGED_BEACON &&
3945                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3946                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3947                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3948                         b43_update_templates(wl);
3949
3950                 if (changed & BSS_CHANGED_BSSID)
3951                         b43_write_mac_bssid_templates(dev);
3952         }
3953
3954         b43_mac_suspend(dev);
3955
3956         /* Update templates for AP/mesh mode. */
3957         if (changed & BSS_CHANGED_BEACON_INT &&
3958             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3959              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3960              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
3961             conf->beacon_int)
3962                 b43_set_beacon_int(dev, conf->beacon_int);
3963
3964         if (changed & BSS_CHANGED_BASIC_RATES)
3965                 b43_update_basic_rates(dev, conf->basic_rates);
3966
3967         if (changed & BSS_CHANGED_ERP_SLOT) {
3968                 if (conf->use_short_slot)
3969                         b43_short_slot_timing_enable(dev);
3970                 else
3971                         b43_short_slot_timing_disable(dev);
3972         }
3973
3974         b43_mac_enable(dev);
3975 out_unlock_mutex:
3976         mutex_unlock(&wl->mutex);
3977 }
3978
3979 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3980                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3981                           struct ieee80211_key_conf *key)
3982 {
3983         struct b43_wl *wl = hw_to_b43_wl(hw);
3984         struct b43_wldev *dev;
3985         u8 algorithm;
3986         u8 index;
3987         int err;
3988         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3989
3990         if (modparam_nohwcrypt)
3991                 return -ENOSPC; /* User disabled HW-crypto */
3992
3993         mutex_lock(&wl->mutex);
3994
3995         dev = wl->current_dev;
3996         err = -ENODEV;
3997         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3998                 goto out_unlock;
3999
4000         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4001                 /* We don't have firmware for the crypto engine.
4002                  * Must use software-crypto. */
4003                 err = -EOPNOTSUPP;
4004                 goto out_unlock;
4005         }
4006
4007         err = -EINVAL;
4008         switch (key->cipher) {
4009         case WLAN_CIPHER_SUITE_WEP40:
4010                 algorithm = B43_SEC_ALGO_WEP40;
4011                 break;
4012         case WLAN_CIPHER_SUITE_WEP104:
4013                 algorithm = B43_SEC_ALGO_WEP104;
4014                 break;
4015         case WLAN_CIPHER_SUITE_TKIP:
4016                 algorithm = B43_SEC_ALGO_TKIP;
4017                 break;
4018         case WLAN_CIPHER_SUITE_CCMP:
4019                 algorithm = B43_SEC_ALGO_AES;
4020                 break;
4021         default:
4022                 B43_WARN_ON(1);
4023                 goto out_unlock;
4024         }
4025         index = (u8) (key->keyidx);
4026         if (index > 3)
4027                 goto out_unlock;
4028
4029         switch (cmd) {
4030         case SET_KEY:
4031                 if (algorithm == B43_SEC_ALGO_TKIP &&
4032                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4033                     !modparam_hwtkip)) {
4034                         /* We support only pairwise key */
4035                         err = -EOPNOTSUPP;
4036                         goto out_unlock;
4037                 }
4038
4039                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4040                         if (WARN_ON(!sta)) {
4041                                 err = -EOPNOTSUPP;
4042                                 goto out_unlock;
4043                         }
4044                         /* Pairwise key with an assigned MAC address. */
4045                         err = b43_key_write(dev, -1, algorithm,
4046                                             key->key, key->keylen,
4047                                             sta->addr, key);
4048                 } else {
4049                         /* Group key */
4050                         err = b43_key_write(dev, index, algorithm,
4051                                             key->key, key->keylen, NULL, key);
4052                 }
4053                 if (err)
4054                         goto out_unlock;
4055
4056                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4057                     algorithm == B43_SEC_ALGO_WEP104) {
4058                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4059                 } else {
4060                         b43_hf_write(dev,
4061                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4062                 }
4063                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4064                 if (algorithm == B43_SEC_ALGO_TKIP)
4065                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4066                 break;
4067         case DISABLE_KEY: {
4068                 err = b43_key_clear(dev, key->hw_key_idx);
4069                 if (err)
4070                         goto out_unlock;
4071                 break;
4072         }
4073         default:
4074                 B43_WARN_ON(1);
4075         }
4076
4077 out_unlock:
4078         if (!err) {
4079                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4080                        "mac: %pM\n",
4081                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4082                        sta ? sta->addr : bcast_addr);
4083                 b43_dump_keymemory(dev);
4084         }
4085         mutex_unlock(&wl->mutex);
4086
4087         return err;
4088 }
4089
4090 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4091                                     unsigned int changed, unsigned int *fflags,
4092                                     u64 multicast)
4093 {
4094         struct b43_wl *wl = hw_to_b43_wl(hw);
4095         struct b43_wldev *dev;
4096
4097         mutex_lock(&wl->mutex);
4098         dev = wl->current_dev;
4099         if (!dev) {
4100                 *fflags = 0;
4101                 goto out_unlock;
4102         }
4103
4104         *fflags &= FIF_PROMISC_IN_BSS |
4105                   FIF_ALLMULTI |
4106                   FIF_FCSFAIL |
4107                   FIF_PLCPFAIL |
4108                   FIF_CONTROL |
4109                   FIF_OTHER_BSS |
4110                   FIF_BCN_PRBRESP_PROMISC;
4111
4112         changed &= FIF_PROMISC_IN_BSS |
4113                    FIF_ALLMULTI |
4114                    FIF_FCSFAIL |
4115                    FIF_PLCPFAIL |
4116                    FIF_CONTROL |
4117                    FIF_OTHER_BSS |
4118                    FIF_BCN_PRBRESP_PROMISC;
4119
4120         wl->filter_flags = *fflags;
4121
4122         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4123                 b43_adjust_opmode(dev);
4124
4125 out_unlock:
4126         mutex_unlock(&wl->mutex);
4127 }
4128
4129 /* Locking: wl->mutex
4130  * Returns the current dev. This might be different from the passed in dev,
4131  * because the core might be gone away while we unlocked the mutex. */
4132 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4133 {
4134         struct b43_wl *wl;
4135         struct b43_wldev *orig_dev;
4136         u32 mask;
4137
4138         if (!dev)
4139                 return NULL;
4140         wl = dev->wl;
4141 redo:
4142         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4143                 return dev;
4144
4145         /* Cancel work. Unlock to avoid deadlocks. */
4146         mutex_unlock(&wl->mutex);
4147         cancel_delayed_work_sync(&dev->periodic_work);
4148         cancel_work_sync(&wl->tx_work);
4149         mutex_lock(&wl->mutex);
4150         dev = wl->current_dev;
4151         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4152                 /* Whoops, aliens ate up the device while we were unlocked. */
4153                 return dev;
4154         }
4155
4156         /* Disable interrupts on the device. */
4157         b43_set_status(dev, B43_STAT_INITIALIZED);
4158         if (b43_bus_host_is_sdio(dev->dev)) {
4159                 /* wl->mutex is locked. That is enough. */
4160                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4161                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4162         } else {
4163                 spin_lock_irq(&wl->hardirq_lock);
4164                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4165                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4166                 spin_unlock_irq(&wl->hardirq_lock);
4167         }
4168         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4169         orig_dev = dev;
4170         mutex_unlock(&wl->mutex);
4171         if (b43_bus_host_is_sdio(dev->dev)) {
4172                 b43_sdio_free_irq(dev);
4173         } else {
4174                 synchronize_irq(dev->dev->irq);
4175                 free_irq(dev->dev->irq, dev);
4176         }
4177         mutex_lock(&wl->mutex);
4178         dev = wl->current_dev;
4179         if (!dev)
4180                 return dev;
4181         if (dev != orig_dev) {
4182                 if (b43_status(dev) >= B43_STAT_STARTED)
4183                         goto redo;
4184                 return dev;
4185         }
4186         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4187         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4188
4189         /* Drain the TX queue */
4190         while (skb_queue_len(&wl->tx_queue))
4191                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4192
4193         b43_mac_suspend(dev);
4194         b43_leds_exit(dev);
4195         b43dbg(wl, "Wireless interface stopped\n");
4196
4197         return dev;
4198 }
4199
4200 /* Locking: wl->mutex */
4201 static int b43_wireless_core_start(struct b43_wldev *dev)
4202 {
4203         int err;
4204
4205         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4206
4207         drain_txstatus_queue(dev);
4208         if (b43_bus_host_is_sdio(dev->dev)) {
4209                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4210                 if (err) {
4211                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4212                         goto out;
4213                 }
4214         } else {
4215                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4216                                            b43_interrupt_thread_handler,
4217                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4218                 if (err) {
4219                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4220                                dev->dev->irq);
4221                         goto out;
4222                 }
4223         }
4224
4225         /* We are ready to run. */
4226         ieee80211_wake_queues(dev->wl->hw);
4227         b43_set_status(dev, B43_STAT_STARTED);
4228
4229         /* Start data flow (TX/RX). */
4230         b43_mac_enable(dev);
4231         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4232
4233         /* Start maintenance work */
4234         b43_periodic_tasks_setup(dev);
4235
4236         b43_leds_init(dev);
4237
4238         b43dbg(dev->wl, "Wireless interface started\n");
4239 out:
4240         return err;
4241 }
4242
4243 /* Get PHY and RADIO versioning numbers */
4244 static int b43_phy_versioning(struct b43_wldev *dev)
4245 {
4246         struct b43_phy *phy = &dev->phy;
4247         u32 tmp;
4248         u8 analog_type;
4249         u8 phy_type;
4250         u8 phy_rev;
4251         u16 radio_manuf;
4252         u16 radio_ver;
4253         u16 radio_rev;
4254         int unsupported = 0;
4255
4256         /* Get PHY versioning */
4257         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4258         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4259         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4260         phy_rev = (tmp & B43_PHYVER_VERSION);
4261         switch (phy_type) {
4262         case B43_PHYTYPE_A:
4263                 if (phy_rev >= 4)
4264                         unsupported = 1;
4265                 break;
4266         case B43_PHYTYPE_B:
4267                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4268                     && phy_rev != 7)
4269                         unsupported = 1;
4270                 break;
4271         case B43_PHYTYPE_G:
4272                 if (phy_rev > 9)
4273                         unsupported = 1;
4274                 break;
4275 #ifdef CONFIG_B43_PHY_N
4276         case B43_PHYTYPE_N:
4277                 if (phy_rev > 9)
4278                         unsupported = 1;
4279                 break;
4280 #endif
4281 #ifdef CONFIG_B43_PHY_LP
4282         case B43_PHYTYPE_LP:
4283                 if (phy_rev > 2)
4284                         unsupported = 1;
4285                 break;
4286 #endif
4287 #ifdef CONFIG_B43_PHY_HT
4288         case B43_PHYTYPE_HT:
4289                 if (phy_rev > 1)
4290                         unsupported = 1;
4291                 break;
4292 #endif
4293 #ifdef CONFIG_B43_PHY_LCN
4294         case B43_PHYTYPE_LCN:
4295                 if (phy_rev > 1)
4296                         unsupported = 1;
4297                 break;
4298 #endif
4299         default:
4300                 unsupported = 1;
4301         }
4302         if (unsupported) {
4303                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4304                        "(Analog %u, Type %u, Revision %u)\n",
4305                        analog_type, phy_type, phy_rev);
4306                 return -EOPNOTSUPP;
4307         }
4308         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4309                analog_type, phy_type, phy_rev);
4310
4311         /* Get RADIO versioning */
4312         if (dev->dev->core_rev >= 24) {
4313                 u16 radio24[3];
4314
4315                 for (tmp = 0; tmp < 3; tmp++) {
4316                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4317                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4318                 }
4319
4320                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4321                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4322
4323                 radio_manuf = 0x17F;
4324                 radio_ver = (radio24[2] << 8) | radio24[1];
4325                 radio_rev = (radio24[0] & 0xF);
4326         } else {
4327                 if (dev->dev->chip_id == 0x4317) {
4328                         if (dev->dev->chip_rev == 0)
4329                                 tmp = 0x3205017F;
4330                         else if (dev->dev->chip_rev == 1)
4331                                 tmp = 0x4205017F;
4332                         else
4333                                 tmp = 0x5205017F;
4334                 } else {
4335                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4336                                     B43_RADIOCTL_ID);
4337                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4338                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4339                                     B43_RADIOCTL_ID);
4340                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4341                                 << 16;
4342                 }
4343                 radio_manuf = (tmp & 0x00000FFF);
4344                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4345                 radio_rev = (tmp & 0xF0000000) >> 28;
4346         }
4347
4348         if (radio_manuf != 0x17F /* Broadcom */)
4349                 unsupported = 1;
4350         switch (phy_type) {
4351         case B43_PHYTYPE_A:
4352                 if (radio_ver != 0x2060)
4353                         unsupported = 1;
4354                 if (radio_rev != 1)
4355                         unsupported = 1;
4356                 if (radio_manuf != 0x17F)
4357                         unsupported = 1;
4358                 break;
4359         case B43_PHYTYPE_B:
4360                 if ((radio_ver & 0xFFF0) != 0x2050)
4361                         unsupported = 1;
4362                 break;
4363         case B43_PHYTYPE_G:
4364                 if (radio_ver != 0x2050)
4365                         unsupported = 1;
4366                 break;
4367         case B43_PHYTYPE_N:
4368                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4369                         unsupported = 1;
4370                 break;
4371         case B43_PHYTYPE_LP:
4372                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4373                         unsupported = 1;
4374                 break;
4375         case B43_PHYTYPE_HT:
4376                 if (radio_ver != 0x2059)
4377                         unsupported = 1;
4378                 break;
4379         case B43_PHYTYPE_LCN:
4380                 if (radio_ver != 0x2064)
4381                         unsupported = 1;
4382                 break;
4383         default:
4384                 B43_WARN_ON(1);
4385         }
4386         if (unsupported) {
4387                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4388                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4389                        radio_manuf, radio_ver, radio_rev);
4390                 return -EOPNOTSUPP;
4391         }
4392         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4393                radio_manuf, radio_ver, radio_rev);
4394
4395         phy->radio_manuf = radio_manuf;
4396         phy->radio_ver = radio_ver;
4397         phy->radio_rev = radio_rev;
4398
4399         phy->analog = analog_type;
4400         phy->type = phy_type;
4401         phy->rev = phy_rev;
4402
4403         return 0;
4404 }
4405
4406 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4407                                       struct b43_phy *phy)
4408 {
4409         phy->hardware_power_control = !!modparam_hwpctl;
4410         phy->next_txpwr_check_time = jiffies;
4411         /* PHY TX errors counter. */
4412         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4413
4414 #if B43_DEBUG
4415         phy->phy_locked = 0;
4416         phy->radio_locked = 0;
4417 #endif
4418 }
4419
4420 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4421 {
4422         dev->dfq_valid = 0;
4423
4424         /* Assume the radio is enabled. If it's not enabled, the state will
4425          * immediately get fixed on the first periodic work run. */
4426         dev->radio_hw_enable = 1;
4427
4428         /* Stats */
4429         memset(&dev->stats, 0, sizeof(dev->stats));
4430
4431         setup_struct_phy_for_init(dev, &dev->phy);
4432
4433         /* IRQ related flags */
4434         dev->irq_reason = 0;
4435         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4436         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4437         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4438                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4439
4440         dev->mac_suspended = 1;
4441
4442         /* Noise calculation context */
4443         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4444 }
4445
4446 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4447 {
4448         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4449         u64 hf;
4450
4451         if (!modparam_btcoex)
4452                 return;
4453         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4454                 return;
4455         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4456                 return;
4457
4458         hf = b43_hf_read(dev);
4459         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4460                 hf |= B43_HF_BTCOEXALT;
4461         else
4462                 hf |= B43_HF_BTCOEX;
4463         b43_hf_write(dev, hf);
4464 }
4465
4466 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4467 {
4468         if (!modparam_btcoex)
4469                 return;
4470         //TODO
4471 }
4472
4473 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4474 {
4475         struct ssb_bus *bus;
4476         u32 tmp;
4477
4478         if (dev->dev->bus_type != B43_BUS_SSB)
4479                 return;
4480
4481         bus = dev->dev->sdev->bus;
4482
4483         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4484             (bus->chip_id == 0x4312)) {
4485                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4486                 tmp &= ~SSB_IMCFGLO_REQTO;
4487                 tmp &= ~SSB_IMCFGLO_SERTO;
4488                 tmp |= 0x3;
4489                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4490                 ssb_commit_settings(bus);
4491         }
4492 }
4493
4494 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4495 {
4496         u16 pu_delay;
4497
4498         /* The time value is in microseconds. */
4499         if (dev->phy.type == B43_PHYTYPE_A)
4500                 pu_delay = 3700;
4501         else
4502                 pu_delay = 1050;
4503         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4504                 pu_delay = 500;
4505         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4506                 pu_delay = max(pu_delay, (u16)2400);
4507
4508         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4509 }
4510
4511 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4512 static void b43_set_pretbtt(struct b43_wldev *dev)
4513 {
4514         u16 pretbtt;
4515
4516         /* The time value is in microseconds. */
4517         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4518                 pretbtt = 2;
4519         } else {
4520                 if (dev->phy.type == B43_PHYTYPE_A)
4521                         pretbtt = 120;
4522                 else
4523                         pretbtt = 250;
4524         }
4525         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4526         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4527 }
4528
4529 /* Shutdown a wireless core */
4530 /* Locking: wl->mutex */
4531 static void b43_wireless_core_exit(struct b43_wldev *dev)
4532 {
4533         u32 macctl;
4534
4535         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4536         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4537                 return;
4538
4539         /* Unregister HW RNG driver */
4540         b43_rng_exit(dev->wl);
4541
4542         b43_set_status(dev, B43_STAT_UNINIT);
4543
4544         /* Stop the microcode PSM. */
4545         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4546         macctl &= ~B43_MACCTL_PSM_RUN;
4547         macctl |= B43_MACCTL_PSM_JMP0;
4548         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4549
4550         b43_dma_free(dev);
4551         b43_pio_free(dev);
4552         b43_chip_exit(dev);
4553         dev->phy.ops->switch_analog(dev, 0);
4554         if (dev->wl->current_beacon) {
4555                 dev_kfree_skb_any(dev->wl->current_beacon);
4556                 dev->wl->current_beacon = NULL;
4557         }
4558
4559         b43_device_disable(dev, 0);
4560         b43_bus_may_powerdown(dev);
4561 }
4562
4563 /* Initialize a wireless core */
4564 static int b43_wireless_core_init(struct b43_wldev *dev)
4565 {
4566         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4567         struct b43_phy *phy = &dev->phy;
4568         int err;
4569         u64 hf;
4570
4571         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4572
4573         err = b43_bus_powerup(dev, 0);
4574         if (err)
4575                 goto out;
4576         if (!b43_device_is_enabled(dev))
4577                 b43_wireless_core_reset(dev, phy->gmode);
4578
4579         /* Reset all data structures. */
4580         setup_struct_wldev_for_init(dev);
4581         phy->ops->prepare_structs(dev);
4582
4583         /* Enable IRQ routing to this device. */
4584         switch (dev->dev->bus_type) {
4585 #ifdef CONFIG_B43_BCMA
4586         case B43_BUS_BCMA:
4587                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4588                                       dev->dev->bdev, true);
4589                 break;
4590 #endif
4591 #ifdef CONFIG_B43_SSB
4592         case B43_BUS_SSB:
4593                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4594                                                dev->dev->sdev);
4595                 break;
4596 #endif
4597         }
4598
4599         b43_imcfglo_timeouts_workaround(dev);
4600         b43_bluetooth_coext_disable(dev);
4601         if (phy->ops->prepare_hardware) {
4602                 err = phy->ops->prepare_hardware(dev);
4603                 if (err)
4604                         goto err_busdown;
4605         }
4606         err = b43_chip_init(dev);
4607         if (err)
4608                 goto err_busdown;
4609         b43_shm_write16(dev, B43_SHM_SHARED,
4610                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4611         hf = b43_hf_read(dev);
4612         if (phy->type == B43_PHYTYPE_G) {
4613                 hf |= B43_HF_SYMW;
4614                 if (phy->rev == 1)
4615                         hf |= B43_HF_GDCW;
4616                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4617                         hf |= B43_HF_OFDMPABOOST;
4618         }
4619         if (phy->radio_ver == 0x2050) {
4620                 if (phy->radio_rev == 6)
4621                         hf |= B43_HF_4318TSSI;
4622                 if (phy->radio_rev < 6)
4623                         hf |= B43_HF_VCORECALC;
4624         }
4625         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4626                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4627 #ifdef CONFIG_SSB_DRIVER_PCICORE
4628         if (dev->dev->bus_type == B43_BUS_SSB &&
4629             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4630             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4631                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4632 #endif
4633         hf &= ~B43_HF_SKCFPUP;
4634         b43_hf_write(dev, hf);
4635
4636         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4637                              B43_DEFAULT_LONG_RETRY_LIMIT);
4638         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4639         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4640
4641         /* Disable sending probe responses from firmware.
4642          * Setting the MaxTime to one usec will always trigger
4643          * a timeout, so we never send any probe resp.
4644          * A timeout of zero is infinite. */
4645         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4646
4647         b43_rate_memory_init(dev);
4648         b43_set_phytxctl_defaults(dev);
4649
4650         /* Minimum Contention Window */
4651         if (phy->type == B43_PHYTYPE_B)
4652                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4653         else
4654                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4655         /* Maximum Contention Window */
4656         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4657
4658         if (b43_bus_host_is_pcmcia(dev->dev) ||
4659             b43_bus_host_is_sdio(dev->dev)) {
4660                 dev->__using_pio_transfers = 1;
4661                 err = b43_pio_init(dev);
4662         } else if (dev->use_pio) {
4663                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4664                         "This should not be needed and will result in lower "
4665                         "performance.\n");
4666                 dev->__using_pio_transfers = 1;
4667                 err = b43_pio_init(dev);
4668         } else {
4669                 dev->__using_pio_transfers = 0;
4670                 err = b43_dma_init(dev);
4671         }
4672         if (err)
4673                 goto err_chip_exit;
4674         b43_qos_init(dev);
4675         b43_set_synth_pu_delay(dev, 1);
4676         b43_bluetooth_coext_enable(dev);
4677
4678         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4679         b43_upload_card_macaddress(dev);
4680         b43_security_init(dev);
4681
4682         ieee80211_wake_queues(dev->wl->hw);
4683
4684         b43_set_status(dev, B43_STAT_INITIALIZED);
4685
4686         /* Register HW RNG driver */
4687         b43_rng_init(dev->wl);
4688
4689 out:
4690         return err;
4691
4692 err_chip_exit:
4693         b43_chip_exit(dev);
4694 err_busdown:
4695         b43_bus_may_powerdown(dev);
4696         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4697         return err;
4698 }
4699
4700 static int b43_op_add_interface(struct ieee80211_hw *hw,
4701                                 struct ieee80211_vif *vif)
4702 {
4703         struct b43_wl *wl = hw_to_b43_wl(hw);
4704         struct b43_wldev *dev;
4705         int err = -EOPNOTSUPP;
4706
4707         /* TODO: allow WDS/AP devices to coexist */
4708
4709         if (vif->type != NL80211_IFTYPE_AP &&
4710             vif->type != NL80211_IFTYPE_MESH_POINT &&
4711             vif->type != NL80211_IFTYPE_STATION &&
4712             vif->type != NL80211_IFTYPE_WDS &&
4713             vif->type != NL80211_IFTYPE_ADHOC)
4714                 return -EOPNOTSUPP;
4715
4716         mutex_lock(&wl->mutex);
4717         if (wl->operating)
4718                 goto out_mutex_unlock;
4719
4720         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4721
4722         dev = wl->current_dev;
4723         wl->operating = 1;
4724         wl->vif = vif;
4725         wl->if_type = vif->type;
4726         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4727
4728         b43_adjust_opmode(dev);
4729         b43_set_pretbtt(dev);
4730         b43_set_synth_pu_delay(dev, 0);
4731         b43_upload_card_macaddress(dev);
4732
4733         err = 0;
4734  out_mutex_unlock:
4735         mutex_unlock(&wl->mutex);
4736
4737         if (err == 0)
4738                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4739
4740         return err;
4741 }
4742
4743 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4744                                     struct ieee80211_vif *vif)
4745 {
4746         struct b43_wl *wl = hw_to_b43_wl(hw);
4747         struct b43_wldev *dev = wl->current_dev;
4748
4749         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4750
4751         mutex_lock(&wl->mutex);
4752
4753         B43_WARN_ON(!wl->operating);
4754         B43_WARN_ON(wl->vif != vif);
4755         wl->vif = NULL;
4756
4757         wl->operating = 0;
4758
4759         b43_adjust_opmode(dev);
4760         memset(wl->mac_addr, 0, ETH_ALEN);
4761         b43_upload_card_macaddress(dev);
4762
4763         mutex_unlock(&wl->mutex);
4764 }
4765
4766 static int b43_op_start(struct ieee80211_hw *hw)
4767 {
4768         struct b43_wl *wl = hw_to_b43_wl(hw);
4769         struct b43_wldev *dev = wl->current_dev;
4770         int did_init = 0;
4771         int err = 0;
4772
4773         /* Kill all old instance specific information to make sure
4774          * the card won't use it in the short timeframe between start
4775          * and mac80211 reconfiguring it. */
4776         memset(wl->bssid, 0, ETH_ALEN);
4777         memset(wl->mac_addr, 0, ETH_ALEN);
4778         wl->filter_flags = 0;
4779         wl->radiotap_enabled = 0;
4780         b43_qos_clear(wl);
4781         wl->beacon0_uploaded = 0;
4782         wl->beacon1_uploaded = 0;
4783         wl->beacon_templates_virgin = 1;
4784         wl->radio_enabled = 1;
4785
4786         mutex_lock(&wl->mutex);
4787
4788         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4789                 err = b43_wireless_core_init(dev);
4790                 if (err)
4791                         goto out_mutex_unlock;
4792                 did_init = 1;
4793         }
4794
4795         if (b43_status(dev) < B43_STAT_STARTED) {
4796                 err = b43_wireless_core_start(dev);
4797                 if (err) {
4798                         if (did_init)
4799                                 b43_wireless_core_exit(dev);
4800                         goto out_mutex_unlock;
4801                 }
4802         }
4803
4804         /* XXX: only do if device doesn't support rfkill irq */
4805         wiphy_rfkill_start_polling(hw->wiphy);
4806
4807  out_mutex_unlock:
4808         mutex_unlock(&wl->mutex);
4809
4810         /* reload configuration */
4811         b43_op_config(hw, ~0);
4812
4813         return err;
4814 }
4815
4816 static void b43_op_stop(struct ieee80211_hw *hw)
4817 {
4818         struct b43_wl *wl = hw_to_b43_wl(hw);
4819         struct b43_wldev *dev = wl->current_dev;
4820
4821         cancel_work_sync(&(wl->beacon_update_trigger));
4822
4823         mutex_lock(&wl->mutex);
4824         if (b43_status(dev) >= B43_STAT_STARTED) {
4825                 dev = b43_wireless_core_stop(dev);
4826                 if (!dev)
4827                         goto out_unlock;
4828         }
4829         b43_wireless_core_exit(dev);
4830         wl->radio_enabled = 0;
4831
4832 out_unlock:
4833         mutex_unlock(&wl->mutex);
4834
4835         cancel_work_sync(&(wl->txpower_adjust_work));
4836 }
4837
4838 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4839                                  struct ieee80211_sta *sta, bool set)
4840 {
4841         struct b43_wl *wl = hw_to_b43_wl(hw);
4842
4843         /* FIXME: add locking */
4844         b43_update_templates(wl);
4845
4846         return 0;
4847 }
4848
4849 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4850                               struct ieee80211_vif *vif,
4851                               enum sta_notify_cmd notify_cmd,
4852                               struct ieee80211_sta *sta)
4853 {
4854         struct b43_wl *wl = hw_to_b43_wl(hw);
4855
4856         B43_WARN_ON(!vif || wl->vif != vif);
4857 }
4858
4859 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4860 {
4861         struct b43_wl *wl = hw_to_b43_wl(hw);
4862         struct b43_wldev *dev;
4863
4864         mutex_lock(&wl->mutex);
4865         dev = wl->current_dev;
4866         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4867                 /* Disable CFP update during scan on other channels. */
4868                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4869         }
4870         mutex_unlock(&wl->mutex);
4871 }
4872
4873 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4874 {
4875         struct b43_wl *wl = hw_to_b43_wl(hw);
4876         struct b43_wldev *dev;
4877
4878         mutex_lock(&wl->mutex);
4879         dev = wl->current_dev;
4880         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4881                 /* Re-enable CFP update. */
4882                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4883         }
4884         mutex_unlock(&wl->mutex);
4885 }
4886
4887 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4888                              struct survey_info *survey)
4889 {
4890         struct b43_wl *wl = hw_to_b43_wl(hw);
4891         struct b43_wldev *dev = wl->current_dev;
4892         struct ieee80211_conf *conf = &hw->conf;
4893
4894         if (idx != 0)
4895                 return -ENOENT;
4896
4897         survey->channel = conf->channel;
4898         survey->filled = SURVEY_INFO_NOISE_DBM;
4899         survey->noise = dev->stats.link_noise;
4900
4901         return 0;
4902 }
4903
4904 static const struct ieee80211_ops b43_hw_ops = {
4905         .tx                     = b43_op_tx,
4906         .conf_tx                = b43_op_conf_tx,
4907         .add_interface          = b43_op_add_interface,
4908         .remove_interface       = b43_op_remove_interface,
4909         .config                 = b43_op_config,
4910         .bss_info_changed       = b43_op_bss_info_changed,
4911         .configure_filter       = b43_op_configure_filter,
4912         .set_key                = b43_op_set_key,
4913         .update_tkip_key        = b43_op_update_tkip_key,
4914         .get_stats              = b43_op_get_stats,
4915         .get_tsf                = b43_op_get_tsf,
4916         .set_tsf                = b43_op_set_tsf,
4917         .start                  = b43_op_start,
4918         .stop                   = b43_op_stop,
4919         .set_tim                = b43_op_beacon_set_tim,
4920         .sta_notify             = b43_op_sta_notify,
4921         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4922         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4923         .get_survey             = b43_op_get_survey,
4924         .rfkill_poll            = b43_rfkill_poll,
4925 };
4926
4927 /* Hard-reset the chip. Do not call this directly.
4928  * Use b43_controller_restart()
4929  */
4930 static void b43_chip_reset(struct work_struct *work)
4931 {
4932         struct b43_wldev *dev =
4933             container_of(work, struct b43_wldev, restart_work);
4934         struct b43_wl *wl = dev->wl;
4935         int err = 0;
4936         int prev_status;
4937
4938         mutex_lock(&wl->mutex);
4939
4940         prev_status = b43_status(dev);
4941         /* Bring the device down... */
4942         if (prev_status >= B43_STAT_STARTED) {
4943                 dev = b43_wireless_core_stop(dev);
4944                 if (!dev) {
4945                         err = -ENODEV;
4946                         goto out;
4947                 }
4948         }
4949         if (prev_status >= B43_STAT_INITIALIZED)
4950                 b43_wireless_core_exit(dev);
4951
4952         /* ...and up again. */
4953         if (prev_status >= B43_STAT_INITIALIZED) {
4954                 err = b43_wireless_core_init(dev);
4955                 if (err)
4956                         goto out;
4957         }
4958         if (prev_status >= B43_STAT_STARTED) {
4959                 err = b43_wireless_core_start(dev);
4960                 if (err) {
4961                         b43_wireless_core_exit(dev);
4962                         goto out;
4963                 }
4964         }
4965 out:
4966         if (err)
4967                 wl->current_dev = NULL; /* Failed to init the dev. */
4968         mutex_unlock(&wl->mutex);
4969
4970         if (err) {
4971                 b43err(wl, "Controller restart FAILED\n");
4972                 return;
4973         }
4974
4975         /* reload configuration */
4976         b43_op_config(wl->hw, ~0);
4977         if (wl->vif)
4978                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
4979
4980         b43info(wl, "Controller restarted\n");
4981 }
4982
4983 static int b43_setup_bands(struct b43_wldev *dev,
4984                            bool have_2ghz_phy, bool have_5ghz_phy)
4985 {
4986         struct ieee80211_hw *hw = dev->wl->hw;
4987
4988         if (have_2ghz_phy)
4989                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4990         if (dev->phy.type == B43_PHYTYPE_N) {
4991                 if (have_5ghz_phy)
4992                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4993         } else {
4994                 if (have_5ghz_phy)
4995                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4996         }
4997
4998         dev->phy.supports_2ghz = have_2ghz_phy;
4999         dev->phy.supports_5ghz = have_5ghz_phy;
5000
5001         return 0;
5002 }
5003
5004 static void b43_wireless_core_detach(struct b43_wldev *dev)
5005 {
5006         /* We release firmware that late to not be required to re-request
5007          * is all the time when we reinit the core. */
5008         b43_release_firmware(dev);
5009         b43_phy_free(dev);
5010 }
5011
5012 static int b43_wireless_core_attach(struct b43_wldev *dev)
5013 {
5014         struct b43_wl *wl = dev->wl;
5015         struct pci_dev *pdev = NULL;
5016         int err;
5017         u32 tmp;
5018         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
5019
5020         /* Do NOT do any device initialization here.
5021          * Do it in wireless_core_init() instead.
5022          * This function is for gathering basic information about the HW, only.
5023          * Also some structs may be set up here. But most likely you want to have
5024          * that in core_init(), too.
5025          */
5026
5027 #ifdef CONFIG_B43_SSB
5028         if (dev->dev->bus_type == B43_BUS_SSB &&
5029             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5030                 pdev = dev->dev->sdev->bus->host_pci;
5031 #endif
5032
5033         err = b43_bus_powerup(dev, 0);
5034         if (err) {
5035                 b43err(wl, "Bus powerup failed\n");
5036                 goto out;
5037         }
5038
5039         /* Get the PHY type. */
5040         switch (dev->dev->bus_type) {
5041 #ifdef CONFIG_B43_BCMA
5042         case B43_BUS_BCMA:
5043                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5044                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5045                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5046                 break;
5047 #endif
5048 #ifdef CONFIG_B43_SSB
5049         case B43_BUS_SSB:
5050                 if (dev->dev->core_rev >= 5) {
5051                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5052                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5053                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5054                 } else
5055                         B43_WARN_ON(1);
5056                 break;
5057 #endif
5058         }
5059
5060         dev->phy.gmode = have_2ghz_phy;
5061         dev->phy.radio_on = 1;
5062         b43_wireless_core_reset(dev, dev->phy.gmode);
5063
5064         err = b43_phy_versioning(dev);
5065         if (err)
5066                 goto err_powerdown;
5067         /* Check if this device supports multiband. */
5068         if (!pdev ||
5069             (pdev->device != 0x4312 &&
5070              pdev->device != 0x4319 && pdev->device != 0x4324)) {
5071                 /* No multiband support. */
5072                 have_2ghz_phy = 0;
5073                 have_5ghz_phy = 0;
5074                 switch (dev->phy.type) {
5075                 case B43_PHYTYPE_A:
5076                         have_5ghz_phy = 1;
5077                         break;
5078                 case B43_PHYTYPE_LP: //FIXME not always!
5079 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
5080                         have_5ghz_phy = 1;
5081 #endif
5082                 case B43_PHYTYPE_G:
5083                 case B43_PHYTYPE_N:
5084                 case B43_PHYTYPE_HT:
5085                 case B43_PHYTYPE_LCN:
5086                         have_2ghz_phy = 1;
5087                         break;
5088                 default:
5089                         B43_WARN_ON(1);
5090                 }
5091         }
5092         if (dev->phy.type == B43_PHYTYPE_A) {
5093                 /* FIXME */
5094                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
5095                 err = -EOPNOTSUPP;
5096                 goto err_powerdown;
5097         }
5098         if (1 /* disable A-PHY */) {
5099                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
5100                 if (dev->phy.type != B43_PHYTYPE_N &&
5101                     dev->phy.type != B43_PHYTYPE_LP) {
5102                         have_2ghz_phy = 1;
5103                         have_5ghz_phy = 0;
5104                 }
5105         }
5106
5107         err = b43_phy_allocate(dev);
5108         if (err)
5109                 goto err_powerdown;
5110
5111         dev->phy.gmode = have_2ghz_phy;
5112         b43_wireless_core_reset(dev, dev->phy.gmode);
5113
5114         err = b43_validate_chipaccess(dev);
5115         if (err)
5116                 goto err_phy_free;
5117         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5118         if (err)
5119                 goto err_phy_free;
5120
5121         /* Now set some default "current_dev" */
5122         if (!wl->current_dev)
5123                 wl->current_dev = dev;
5124         INIT_WORK(&dev->restart_work, b43_chip_reset);
5125
5126         dev->phy.ops->switch_analog(dev, 0);
5127         b43_device_disable(dev, 0);
5128         b43_bus_may_powerdown(dev);
5129
5130 out:
5131         return err;
5132
5133 err_phy_free:
5134         b43_phy_free(dev);
5135 err_powerdown:
5136         b43_bus_may_powerdown(dev);
5137         return err;
5138 }
5139
5140 static void b43_one_core_detach(struct b43_bus_dev *dev)
5141 {
5142         struct b43_wldev *wldev;
5143         struct b43_wl *wl;
5144
5145         /* Do not cancel ieee80211-workqueue based work here.
5146          * See comment in b43_remove(). */
5147
5148         wldev = b43_bus_get_wldev(dev);
5149         wl = wldev->wl;
5150         b43_debugfs_remove_device(wldev);
5151         b43_wireless_core_detach(wldev);
5152         list_del(&wldev->list);
5153         wl->nr_devs--;
5154         b43_bus_set_wldev(dev, NULL);
5155         kfree(wldev);
5156 }
5157
5158 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5159 {
5160         struct b43_wldev *wldev;
5161         int err = -ENOMEM;
5162
5163         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5164         if (!wldev)
5165                 goto out;
5166
5167         wldev->use_pio = b43_modparam_pio;
5168         wldev->dev = dev;
5169         wldev->wl = wl;
5170         b43_set_status(wldev, B43_STAT_UNINIT);
5171         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5172         INIT_LIST_HEAD(&wldev->list);
5173
5174         err = b43_wireless_core_attach(wldev);
5175         if (err)
5176                 goto err_kfree_wldev;
5177
5178         list_add(&wldev->list, &wl->devlist);
5179         wl->nr_devs++;
5180         b43_bus_set_wldev(dev, wldev);
5181         b43_debugfs_add_device(wldev);
5182
5183       out:
5184         return err;
5185
5186       err_kfree_wldev:
5187         kfree(wldev);
5188         return err;
5189 }
5190
5191 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5192         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5193         (pdev->device == _device) &&                                    \
5194         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5195         (pdev->subsystem_device == _subdevice)                          )
5196
5197 static void b43_sprom_fixup(struct ssb_bus *bus)
5198 {
5199         struct pci_dev *pdev;
5200
5201         /* boardflags workarounds */
5202         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5203             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5204                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5205         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5206             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5207                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5208         if (bus->bustype == SSB_BUSTYPE_PCI) {
5209                 pdev = bus->host_pci;
5210                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5211                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5212                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5213                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5214                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5215                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5216                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5217                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5218         }
5219 }
5220
5221 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5222 {
5223         struct ieee80211_hw *hw = wl->hw;
5224
5225         ssb_set_devtypedata(dev->sdev, NULL);
5226         ieee80211_free_hw(hw);
5227 }
5228
5229 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5230 {
5231         struct ssb_sprom *sprom = dev->bus_sprom;
5232         struct ieee80211_hw *hw;
5233         struct b43_wl *wl;
5234         char chip_name[6];
5235
5236         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5237         if (!hw) {
5238                 b43err(NULL, "Could not allocate ieee80211 device\n");
5239                 return ERR_PTR(-ENOMEM);
5240         }
5241         wl = hw_to_b43_wl(hw);
5242
5243         /* fill hw info */
5244         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5245                     IEEE80211_HW_SIGNAL_DBM;
5246
5247         hw->wiphy->interface_modes =
5248                 BIT(NL80211_IFTYPE_AP) |
5249                 BIT(NL80211_IFTYPE_MESH_POINT) |
5250                 BIT(NL80211_IFTYPE_STATION) |
5251                 BIT(NL80211_IFTYPE_WDS) |
5252                 BIT(NL80211_IFTYPE_ADHOC);
5253
5254         hw->queues = modparam_qos ? 4 : 1;
5255         wl->mac80211_initially_registered_queues = hw->queues;
5256         hw->max_rates = 2;
5257         SET_IEEE80211_DEV(hw, dev->dev);
5258         if (is_valid_ether_addr(sprom->et1mac))
5259                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5260         else
5261                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5262
5263         /* Initialize struct b43_wl */
5264         wl->hw = hw;
5265         mutex_init(&wl->mutex);
5266         spin_lock_init(&wl->hardirq_lock);
5267         INIT_LIST_HEAD(&wl->devlist);
5268         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5269         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5270         INIT_WORK(&wl->tx_work, b43_tx_work);
5271         skb_queue_head_init(&wl->tx_queue);
5272
5273         snprintf(chip_name, ARRAY_SIZE(chip_name),
5274                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5275         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5276                 dev->core_rev);
5277         return wl;
5278 }
5279
5280 #ifdef CONFIG_B43_BCMA
5281 static int b43_bcma_probe(struct bcma_device *core)
5282 {
5283         struct b43_bus_dev *dev;
5284         struct b43_wl *wl;
5285         int err;
5286
5287         dev = b43_bus_dev_bcma_init(core);
5288         if (!dev)
5289                 return -ENODEV;
5290
5291         wl = b43_wireless_init(dev);
5292         if (IS_ERR(wl)) {
5293                 err = PTR_ERR(wl);
5294                 goto bcma_out;
5295         }
5296
5297         err = b43_one_core_attach(dev, wl);
5298         if (err)
5299                 goto bcma_err_wireless_exit;
5300
5301         err = ieee80211_register_hw(wl->hw);
5302         if (err)
5303                 goto bcma_err_one_core_detach;
5304         b43_leds_register(wl->current_dev);
5305
5306 bcma_out:
5307         return err;
5308
5309 bcma_err_one_core_detach:
5310         b43_one_core_detach(dev);
5311 bcma_err_wireless_exit:
5312         ieee80211_free_hw(wl->hw);
5313         return err;
5314 }
5315
5316 static void b43_bcma_remove(struct bcma_device *core)
5317 {
5318         struct b43_wldev *wldev = bcma_get_drvdata(core);
5319         struct b43_wl *wl = wldev->wl;
5320
5321         /* We must cancel any work here before unregistering from ieee80211,
5322          * as the ieee80211 unreg will destroy the workqueue. */
5323         cancel_work_sync(&wldev->restart_work);
5324
5325         /* Restore the queues count before unregistering, because firmware detect
5326          * might have modified it. Restoring is important, so the networking
5327          * stack can properly free resources. */
5328         wl->hw->queues = wl->mac80211_initially_registered_queues;
5329         b43_leds_stop(wldev);
5330         ieee80211_unregister_hw(wl->hw);
5331
5332         b43_one_core_detach(wldev->dev);
5333
5334         b43_leds_unregister(wl);
5335
5336         ieee80211_free_hw(wl->hw);
5337 }
5338
5339 static struct bcma_driver b43_bcma_driver = {
5340         .name           = KBUILD_MODNAME,
5341         .id_table       = b43_bcma_tbl,
5342         .probe          = b43_bcma_probe,
5343         .remove         = b43_bcma_remove,
5344 };
5345 #endif
5346
5347 #ifdef CONFIG_B43_SSB
5348 static
5349 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5350 {
5351         struct b43_bus_dev *dev;
5352         struct b43_wl *wl;
5353         int err;
5354         int first = 0;
5355
5356         dev = b43_bus_dev_ssb_init(sdev);
5357         if (!dev)
5358                 return -ENOMEM;
5359
5360         wl = ssb_get_devtypedata(sdev);
5361         if (!wl) {
5362                 /* Probing the first core. Must setup common struct b43_wl */
5363                 first = 1;
5364                 b43_sprom_fixup(sdev->bus);
5365                 wl = b43_wireless_init(dev);
5366                 if (IS_ERR(wl)) {
5367                         err = PTR_ERR(wl);
5368                         goto out;
5369                 }
5370                 ssb_set_devtypedata(sdev, wl);
5371                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5372         }
5373         err = b43_one_core_attach(dev, wl);
5374         if (err)
5375                 goto err_wireless_exit;
5376
5377         if (first) {
5378                 err = ieee80211_register_hw(wl->hw);
5379                 if (err)
5380                         goto err_one_core_detach;
5381                 b43_leds_register(wl->current_dev);
5382         }
5383
5384       out:
5385         return err;
5386
5387       err_one_core_detach:
5388         b43_one_core_detach(dev);
5389       err_wireless_exit:
5390         if (first)
5391                 b43_wireless_exit(dev, wl);
5392         return err;
5393 }
5394
5395 static void b43_ssb_remove(struct ssb_device *sdev)
5396 {
5397         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5398         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5399         struct b43_bus_dev *dev = wldev->dev;
5400
5401         /* We must cancel any work here before unregistering from ieee80211,
5402          * as the ieee80211 unreg will destroy the workqueue. */
5403         cancel_work_sync(&wldev->restart_work);
5404
5405         B43_WARN_ON(!wl);
5406         if (wl->current_dev == wldev) {
5407                 /* Restore the queues count before unregistering, because firmware detect
5408                  * might have modified it. Restoring is important, so the networking
5409                  * stack can properly free resources. */
5410                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5411                 b43_leds_stop(wldev);
5412                 ieee80211_unregister_hw(wl->hw);
5413         }
5414
5415         b43_one_core_detach(dev);
5416
5417         if (list_empty(&wl->devlist)) {
5418                 b43_leds_unregister(wl);
5419                 /* Last core on the chip unregistered.
5420                  * We can destroy common struct b43_wl.
5421                  */
5422                 b43_wireless_exit(dev, wl);
5423         }
5424 }
5425
5426 static struct ssb_driver b43_ssb_driver = {
5427         .name           = KBUILD_MODNAME,
5428         .id_table       = b43_ssb_tbl,
5429         .probe          = b43_ssb_probe,
5430         .remove         = b43_ssb_remove,
5431 };
5432 #endif /* CONFIG_B43_SSB */
5433
5434 /* Perform a hardware reset. This can be called from any context. */
5435 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5436 {
5437         /* Must avoid requeueing, if we are in shutdown. */
5438         if (b43_status(dev) < B43_STAT_INITIALIZED)
5439                 return;
5440         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5441         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5442 }
5443
5444 static void b43_print_driverinfo(void)
5445 {
5446         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5447                    *feat_leds = "", *feat_sdio = "";
5448
5449 #ifdef CONFIG_B43_PCI_AUTOSELECT
5450         feat_pci = "P";
5451 #endif
5452 #ifdef CONFIG_B43_PCMCIA
5453         feat_pcmcia = "M";
5454 #endif
5455 #ifdef CONFIG_B43_PHY_N
5456         feat_nphy = "N";
5457 #endif
5458 #ifdef CONFIG_B43_LEDS
5459         feat_leds = "L";
5460 #endif
5461 #ifdef CONFIG_B43_SDIO
5462         feat_sdio = "S";
5463 #endif
5464         printk(KERN_INFO "Broadcom 43xx driver loaded "
5465                "[ Features: %s%s%s%s%s ]\n",
5466                feat_pci, feat_pcmcia, feat_nphy,
5467                feat_leds, feat_sdio);
5468 }
5469
5470 static int __init b43_init(void)
5471 {
5472         int err;
5473
5474         b43_debugfs_init();
5475         err = b43_pcmcia_init();
5476         if (err)
5477                 goto err_dfs_exit;
5478         err = b43_sdio_init();
5479         if (err)
5480                 goto err_pcmcia_exit;
5481 #ifdef CONFIG_B43_BCMA
5482         err = bcma_driver_register(&b43_bcma_driver);
5483         if (err)
5484                 goto err_sdio_exit;
5485 #endif
5486 #ifdef CONFIG_B43_SSB
5487         err = ssb_driver_register(&b43_ssb_driver);
5488         if (err)
5489                 goto err_bcma_driver_exit;
5490 #endif
5491         b43_print_driverinfo();
5492
5493         return err;
5494
5495 #ifdef CONFIG_B43_SSB
5496 err_bcma_driver_exit:
5497 #endif
5498 #ifdef CONFIG_B43_BCMA
5499         bcma_driver_unregister(&b43_bcma_driver);
5500 err_sdio_exit:
5501 #endif
5502         b43_sdio_exit();
5503 err_pcmcia_exit:
5504         b43_pcmcia_exit();
5505 err_dfs_exit:
5506         b43_debugfs_exit();
5507         return err;
5508 }
5509
5510 static void __exit b43_exit(void)
5511 {
5512 #ifdef CONFIG_B43_SSB
5513         ssb_driver_unregister(&b43_ssb_driver);
5514 #endif
5515 #ifdef CONFIG_B43_BCMA
5516         bcma_driver_unregister(&b43_bcma_driver);
5517 #endif
5518         b43_sdio_exit();
5519         b43_pcmcia_exit();
5520         b43_debugfs_exit();
5521 }
5522
5523 module_init(b43_init)
5524 module_exit(b43_exit)