drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_qos = 1;
  84 module_param_named(qos, modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  94
  95
  96 static const struct ssb_device_id b43_ssb_tbl[] = {
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 106         SSB_DEVTABLE_END
 107 };
 108
 109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 110
 111 /* Channel and ratetables are shared for all devices.
 112  * They can't be const, because ieee80211 puts some precalculated
 113  * data in there. This data is the same for all devices, so we don't
 114  * get concurrency issues */
 115 #define RATETAB_ENT(_rateid, _flags) \
 116         {                                                               \
 117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 118                 .hw_value       = (_rateid),                            \
 119                 .flags          = (_flags),                             \
 120         }
 121
 122 /*
 123  * NOTE: When changing this, sync with xmit.c's
 124  *       b43_plcp_get_bitrate_idx_* functions!
 125  */
 126 static struct ieee80211_rate __b43_ratetable[] = {
 127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 139 };
 140
 141 #define b43_a_ratetable         (__b43_ratetable + 4)
 142 #define b43_a_ratetable_size    8
 143 #define b43_b_ratetable         (__b43_ratetable + 0)
 144 #define b43_b_ratetable_size    4
 145 #define b43_g_ratetable         (__b43_ratetable + 0)
 146 #define b43_g_ratetable_size    12
 147
 148 #define CHAN4G(_channel, _freq, _flags) {                       \
 149         .band                   = IEEE80211_BAND_2GHZ,          \
 150         .center_freq            = (_freq),                      \
 151         .hw_value               = (_channel),                   \
 152         .flags                  = (_flags),                     \
 153         .max_antenna_gain       = 0,                            \
 154         .max_power              = 30,                           \
 155 }
 156 static struct ieee80211_channel b43_2ghz_chantable[] = {
 157         CHAN4G(1, 2412, 0),
 158         CHAN4G(2, 2417, 0),
 159         CHAN4G(3, 2422, 0),
 160         CHAN4G(4, 2427, 0),
 161         CHAN4G(5, 2432, 0),
 162         CHAN4G(6, 2437, 0),
 163         CHAN4G(7, 2442, 0),
 164         CHAN4G(8, 2447, 0),
 165         CHAN4G(9, 2452, 0),
 166         CHAN4G(10, 2457, 0),
 167         CHAN4G(11, 2462, 0),
 168         CHAN4G(12, 2467, 0),
 169         CHAN4G(13, 2472, 0),
 170         CHAN4G(14, 2484, 0),
 171 };
 172 #undef CHAN4G
 173
 174 #define CHAN5G(_channel, _flags) {                              \
 175         .band                   = IEEE80211_BAND_5GHZ,          \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .flags                  = (_flags),                     \
 179         .max_antenna_gain       = 0,                            \
 180         .max_power              = 30,                           \
 181 }
 182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 183         CHAN5G(32, 0),          CHAN5G(34, 0),
 184         CHAN5G(36, 0),          CHAN5G(38, 0),
 185         CHAN5G(40, 0),          CHAN5G(42, 0),
 186         CHAN5G(44, 0),          CHAN5G(46, 0),
 187         CHAN5G(48, 0),          CHAN5G(50, 0),
 188         CHAN5G(52, 0),          CHAN5G(54, 0),
 189         CHAN5G(56, 0),          CHAN5G(58, 0),
 190         CHAN5G(60, 0),          CHAN5G(62, 0),
 191         CHAN5G(64, 0),          CHAN5G(66, 0),
 192         CHAN5G(68, 0),          CHAN5G(70, 0),
 193         CHAN5G(72, 0),          CHAN5G(74, 0),
 194         CHAN5G(76, 0),          CHAN5G(78, 0),
 195         CHAN5G(80, 0),          CHAN5G(82, 0),
 196         CHAN5G(84, 0),          CHAN5G(86, 0),
 197         CHAN5G(88, 0),          CHAN5G(90, 0),
 198         CHAN5G(92, 0),          CHAN5G(94, 0),
 199         CHAN5G(96, 0),          CHAN5G(98, 0),
 200         CHAN5G(100, 0),         CHAN5G(102, 0),
 201         CHAN5G(104, 0),         CHAN5G(106, 0),
 202         CHAN5G(108, 0),         CHAN5G(110, 0),
 203         CHAN5G(112, 0),         CHAN5G(114, 0),
 204         CHAN5G(116, 0),         CHAN5G(118, 0),
 205         CHAN5G(120, 0),         CHAN5G(122, 0),
 206         CHAN5G(124, 0),         CHAN5G(126, 0),
 207         CHAN5G(128, 0),         CHAN5G(130, 0),
 208         CHAN5G(132, 0),         CHAN5G(134, 0),
 209         CHAN5G(136, 0),         CHAN5G(138, 0),
 210         CHAN5G(140, 0),         CHAN5G(142, 0),
 211         CHAN5G(144, 0),         CHAN5G(145, 0),
 212         CHAN5G(146, 0),         CHAN5G(147, 0),
 213         CHAN5G(148, 0),         CHAN5G(149, 0),
 214         CHAN5G(150, 0),         CHAN5G(151, 0),
 215         CHAN5G(152, 0),         CHAN5G(153, 0),
 216         CHAN5G(154, 0),         CHAN5G(155, 0),
 217         CHAN5G(156, 0),         CHAN5G(157, 0),
 218         CHAN5G(158, 0),         CHAN5G(159, 0),
 219         CHAN5G(160, 0),         CHAN5G(161, 0),
 220         CHAN5G(162, 0),         CHAN5G(163, 0),
 221         CHAN5G(164, 0),         CHAN5G(165, 0),
 222         CHAN5G(166, 0),         CHAN5G(168, 0),
 223         CHAN5G(170, 0),         CHAN5G(172, 0),
 224         CHAN5G(174, 0),         CHAN5G(176, 0),
 225         CHAN5G(178, 0),         CHAN5G(180, 0),
 226         CHAN5G(182, 0),         CHAN5G(184, 0),
 227         CHAN5G(186, 0),         CHAN5G(188, 0),
 228         CHAN5G(190, 0),         CHAN5G(192, 0),
 229         CHAN5G(194, 0),         CHAN5G(196, 0),
 230         CHAN5G(198, 0),         CHAN5G(200, 0),
 231         CHAN5G(202, 0),         CHAN5G(204, 0),
 232         CHAN5G(206, 0),         CHAN5G(208, 0),
 233         CHAN5G(210, 0),         CHAN5G(212, 0),
 234         CHAN5G(214, 0),         CHAN5G(216, 0),
 235         CHAN5G(218, 0),         CHAN5G(220, 0),
 236         CHAN5G(222, 0),         CHAN5G(224, 0),
 237         CHAN5G(226, 0),         CHAN5G(228, 0),
 238 };
 239
 240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 241         CHAN5G(34, 0),          CHAN5G(36, 0),
 242         CHAN5G(38, 0),          CHAN5G(40, 0),
 243         CHAN5G(42, 0),          CHAN5G(44, 0),
 244         CHAN5G(46, 0),          CHAN5G(48, 0),
 245         CHAN5G(52, 0),          CHAN5G(56, 0),
 246         CHAN5G(60, 0),          CHAN5G(64, 0),
 247         CHAN5G(100, 0),         CHAN5G(104, 0),
 248         CHAN5G(108, 0),         CHAN5G(112, 0),
 249         CHAN5G(116, 0),         CHAN5G(120, 0),
 250         CHAN5G(124, 0),         CHAN5G(128, 0),
 251         CHAN5G(132, 0),         CHAN5G(136, 0),
 252         CHAN5G(140, 0),         CHAN5G(149, 0),
 253         CHAN5G(153, 0),         CHAN5G(157, 0),
 254         CHAN5G(161, 0),         CHAN5G(165, 0),
 255         CHAN5G(184, 0),         CHAN5G(188, 0),
 256         CHAN5G(192, 0),         CHAN5G(196, 0),
 257         CHAN5G(200, 0),         CHAN5G(204, 0),
 258         CHAN5G(208, 0),         CHAN5G(212, 0),
 259         CHAN5G(216, 0),
 260 };
 261 #undef CHAN5G
 262
 263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 264         .band           = IEEE80211_BAND_5GHZ,
 265         .channels       = b43_5ghz_nphy_chantable,
 266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 267         .bitrates       = b43_a_ratetable,
 268         .n_bitrates     = b43_a_ratetable_size,
 269 };
 270
 271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 272         .band           = IEEE80211_BAND_5GHZ,
 273         .channels       = b43_5ghz_aphy_chantable,
 274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 275         .bitrates       = b43_a_ratetable,
 276         .n_bitrates     = b43_a_ratetable_size,
 277 };
 278
 279 static struct ieee80211_supported_band b43_band_2GHz = {
 280         .band           = IEEE80211_BAND_2GHZ,
 281         .channels       = b43_2ghz_chantable,
 282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 283         .bitrates       = b43_g_ratetable,
 284         .n_bitrates     = b43_g_ratetable_size,
 285 };
 286
 287 static void b43_wireless_core_exit(struct b43_wldev *dev);
 288 static int b43_wireless_core_init(struct b43_wldev *dev);
 289 static void b43_wireless_core_stop(struct b43_wldev *dev);
 290 static int b43_wireless_core_start(struct b43_wldev *dev);
 291
 292 static int b43_ratelimit(struct b43_wl *wl)
 293 {
 294         if (!wl || !wl->current_dev)
 295                 return 1;
 296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 297                 return 1;
 298         /* We are up and running.
 299          * Ratelimit the messages to avoid DoS over the net. */
 300         return net_ratelimit();
 301 }
 302
 303 void b43info(struct b43_wl *wl, const char *fmt, ...)
 304 {
 305         va_list args;
 306
 307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 308                 return;
 309         if (!b43_ratelimit(wl))
 310                 return;
 311         va_start(args, fmt);
 312         printk(KERN_INFO "b43-%s: ",
 313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 314         vprintk(fmt, args);
 315         va_end(args);
 316 }
 317
 318 void b43err(struct b43_wl *wl, const char *fmt, ...)
 319 {
 320         va_list args;
 321
 322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 323                 return;
 324         if (!b43_ratelimit(wl))
 325                 return;
 326         va_start(args, fmt);
 327         printk(KERN_ERR "b43-%s ERROR: ",
 328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 329         vprintk(fmt, args);
 330         va_end(args);
 331 }
 332
 333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 334 {
 335         va_list args;
 336
 337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 338                 return;
 339         if (!b43_ratelimit(wl))
 340                 return;
 341         va_start(args, fmt);
 342         printk(KERN_WARNING "b43-%s warning: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347
 348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 349 {
 350         va_list args;
 351
 352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 353                 return;
 354         va_start(args, fmt);
 355         printk(KERN_DEBUG "b43-%s debug: ",
 356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 357         vprintk(fmt, args);
 358         va_end(args);
 359 }
 360
 361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 362 {
 363         u32 macctl;
 364
 365         B43_WARN_ON(offset % 4 != 0);
 366
 367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 368         if (macctl & B43_MACCTL_BE)
 369                 val = swab32(val);
 370
 371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 372         mmiowb();
 373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 374 }
 375
 376 static inline void b43_shm_control_word(struct b43_wldev *dev,
 377                                         u16 routing, u16 offset)
 378 {
 379         u32 control;
 380
 381         /* "offset" is the WORD offset. */
 382         control = routing;
 383         control <<= 16;
 384         control |= offset;
 385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 386 }
 387
 388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 389 {
 390         u32 ret;
 391
 392         if (routing == B43_SHM_SHARED) {
 393                 B43_WARN_ON(offset & 0x0001);
 394                 if (offset & 0x0003) {
 395                         /* Unaligned access */
 396                         b43_shm_control_word(dev, routing, offset >> 2);
 397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 398                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 399                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 400
 401                         goto out;
 402                 }
 403                 offset >>= 2;
 404         }
 405         b43_shm_control_word(dev, routing, offset);
 406         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 407 out:
 408         return ret;
 409 }
 410
 411 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 412 {
 413         struct b43_wl *wl = dev->wl;
 414         unsigned long flags;
 415         u32 ret;
 416
 417         spin_lock_irqsave(&wl->shm_lock, flags);
 418         ret = __b43_shm_read32(dev, routing, offset);
 419         spin_unlock_irqrestore(&wl->shm_lock, flags);
 420
 421         return ret;
 422 }
 423
 424 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 425 {
 426         u16 ret;
 427
 428         if (routing == B43_SHM_SHARED) {
 429                 B43_WARN_ON(offset & 0x0001);
 430                 if (offset & 0x0003) {
 431                         /* Unaligned access */
 432                         b43_shm_control_word(dev, routing, offset >> 2);
 433                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 434
 435                         goto out;
 436                 }
 437                 offset >>= 2;
 438         }
 439         b43_shm_control_word(dev, routing, offset);
 440         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 441 out:
 442         return ret;
 443 }
 444
 445 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 446 {
 447         struct b43_wl *wl = dev->wl;
 448         unsigned long flags;
 449         u16 ret;
 450
 451         spin_lock_irqsave(&wl->shm_lock, flags);
 452         ret = __b43_shm_read16(dev, routing, offset);
 453         spin_unlock_irqrestore(&wl->shm_lock, flags);
 454
 455         return ret;
 456 }
 457
 458 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 459 {
 460         if (routing == B43_SHM_SHARED) {
 461                 B43_WARN_ON(offset & 0x0001);
 462                 if (offset & 0x0003) {
 463                         /* Unaligned access */
 464                         b43_shm_control_word(dev, routing, offset >> 2);
 465                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 466                                     value & 0xFFFF);
 467                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 468                         b43_write16(dev, B43_MMIO_SHM_DATA,
 469                                     (value >> 16) & 0xFFFF);
 470                         return;
 471                 }
 472                 offset >>= 2;
 473         }
 474         b43_shm_control_word(dev, routing, offset);
 475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 476 }
 477
 478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 479 {
 480         struct b43_wl *wl = dev->wl;
 481         unsigned long flags;
 482
 483         spin_lock_irqsave(&wl->shm_lock, flags);
 484         __b43_shm_write32(dev, routing, offset, value);
 485         spin_unlock_irqrestore(&wl->shm_lock, flags);
 486 }
 487
 488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 496                         return;
 497                 }
 498                 offset >>= 2;
 499         }
 500         b43_shm_control_word(dev, routing, offset);
 501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 502 }
 503
 504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 505 {
 506         struct b43_wl *wl = dev->wl;
 507         unsigned long flags;
 508
 509         spin_lock_irqsave(&wl->shm_lock, flags);
 510         __b43_shm_write16(dev, routing, offset, value);
 511         spin_unlock_irqrestore(&wl->shm_lock, flags);
 512 }
 513
 514 /* Read HostFlags */
 515 u64 b43_hf_read(struct b43_wldev *dev)
 516 {
 517         u64 ret;
 518
 519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 522         ret <<= 16;
 523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 524
 525         return ret;
 526 }
 527
 528 /* Write HostFlags */
 529 void b43_hf_write(struct b43_wldev *dev, u64 value)
 530 {
 531         u16 lo, mi, hi;
 532
 533         lo = (value & 0x00000000FFFFULL);
 534         mi = (value & 0x0000FFFF0000ULL) >> 16;
 535         hi = (value & 0xFFFF00000000ULL) >> 32;
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 539 }
 540
 541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 543 {
 544         B43_WARN_ON(!dev->fw.opensource);
 545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 546 }
 547
 548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 549 {
 550         u32 low, high;
 551
 552         B43_WARN_ON(dev->dev->id.revision < 3);
 553
 554         /* The hardware guarantees us an atomic read, if we
 555          * read the low register first. */
 556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 558
 559         *tsf = high;
 560         *tsf <<= 32;
 561         *tsf |= low;
 562 }
 563
 564 static void b43_time_lock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl |= B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_time_unlock(struct b43_wldev *dev)
 576 {
 577         u32 macctl;
 578
 579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 580         macctl &= ~B43_MACCTL_TBTTHOLD;
 581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 582         /* Commit the write */
 583         b43_read32(dev, B43_MMIO_MACCTL);
 584 }
 585
 586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 587 {
 588         u32 low, high;
 589
 590         B43_WARN_ON(dev->dev->id.revision < 3);
 591
 592         low = tsf;
 593         high = (tsf >> 32);
 594         /* The hardware guarantees us an atomic write, if we
 595          * write the low register first. */
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 597         mmiowb();
 598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 599         mmiowb();
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676 }
 677
 678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 20);
 681 }
 682
 683 /* Synchronize IRQ top- and bottom-half.
 684  * IRQs must be masked before calling this.
 685  * This must not be called with the irq_lock held.
 686  */
 687 static void b43_synchronize_irq(struct b43_wldev *dev)
 688 {
 689         synchronize_irq(dev->dev->irq);
 690         tasklet_kill(&dev->isr_tasklet);
 691 }
 692
 693 /* DummyTransmission function, as documented on
 694  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 695  */
 696 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 697 {
 698         struct b43_wl *wl = dev->wl;
 699         struct b43_phy *phy = &dev->phy;
 700         unsigned int i, max_loop;
 701         u16 value;
 702         u32 buffer[5] = {
 703                 0x00000000,
 704                 0x00D40000,
 705                 0x00000000,
 706                 0x01000000,
 707                 0x00000000,
 708         };
 709
 710         if (ofdm) {
 711                 max_loop = 0x1E;
 712                 buffer[0] = 0x000201CC;
 713         } else {
 714                 max_loop = 0xFA;
 715                 buffer[0] = 0x000B846E;
 716         }
 717
 718         spin_lock_irq(&wl->irq_lock);
 719         write_lock(&wl->tx_lock);
 720
 721         for (i = 0; i < 5; i++)
 722                 b43_ram_write(dev, i * 4, buffer[i]);
 723
 724         b43_write16(dev, 0x0568, 0x0000);
 725         if (dev->dev->id.revision < 11)
 726                 b43_write16(dev, 0x07C0, 0x0000);
 727         else
 728                 b43_write16(dev, 0x07C0, 0x0100);
 729         value = (ofdm ? 0x41 : 0x40);
 730         b43_write16(dev, 0x050C, value);
 731         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 732                 b43_write16(dev, 0x0514, 0x1A02);
 733         b43_write16(dev, 0x0508, 0x0000);
 734         b43_write16(dev, 0x050A, 0x0000);
 735         b43_write16(dev, 0x054C, 0x0000);
 736         b43_write16(dev, 0x056A, 0x0014);
 737         b43_write16(dev, 0x0568, 0x0826);
 738         b43_write16(dev, 0x0500, 0x0000);
 739         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 740                 //SPEC TODO
 741         }
 742
 743         switch (phy->type) {
 744         case B43_PHYTYPE_N:
 745                 b43_write16(dev, 0x0502, 0x00D0);
 746                 break;
 747         case B43_PHYTYPE_LP:
 748                 b43_write16(dev, 0x0502, 0x0050);
 749                 break;
 750         default:
 751                 b43_write16(dev, 0x0502, 0x0030);
 752         }
 753
 754         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 755                 b43_radio_write16(dev, 0x0051, 0x0017);
 756         for (i = 0x00; i < max_loop; i++) {
 757                 value = b43_read16(dev, 0x050E);
 758                 if (value & 0x0080)
 759                         break;
 760                 udelay(10);
 761         }
 762         for (i = 0x00; i < 0x0A; i++) {
 763                 value = b43_read16(dev, 0x050E);
 764                 if (value & 0x0400)
 765                         break;
 766                 udelay(10);
 767         }
 768         for (i = 0x00; i < 0x19; i++) {
 769                 value = b43_read16(dev, 0x0690);
 770                 if (!(value & 0x0100))
 771                         break;
 772                 udelay(10);
 773         }
 774         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 775                 b43_radio_write16(dev, 0x0051, 0x0037);
 776
 777         write_unlock(&wl->tx_lock);
 778         spin_unlock_irq(&wl->irq_lock);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 static void do_key_write(struct b43_wldev *dev,
 838                          u8 index, u8 algorithm,
 839                          const u8 *key, size_t key_len, const u8 *mac_addr)
 840 {
 841         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 842         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 843
 844         if (b43_new_kidx_api(dev))
 845                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 846
 847         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 848         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 849
 850         if (index >= pairwise_keys_start)
 851                 keymac_write(dev, index, NULL); /* First zero out mac. */
 852         if (key)
 853                 memcpy(buf, key, key_len);
 854         key_write(dev, index, algorithm, buf);
 855         if (index >= pairwise_keys_start)
 856                 keymac_write(dev, index, mac_addr);
 857
 858         dev->key[index].algorithm = algorithm;
 859 }
 860
 861 static int b43_key_write(struct b43_wldev *dev,
 862                          int index, u8 algorithm,
 863                          const u8 *key, size_t key_len,
 864                          const u8 *mac_addr,
 865                          struct ieee80211_key_conf *keyconf)
 866 {
 867         int i;
 868         int pairwise_keys_start;
 869
 870         if (key_len > B43_SEC_KEYSIZE)
 871                 return -EINVAL;
 872         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 873                 /* Check that we don't already have this key. */
 874                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 875         }
 876         if (index < 0) {
 877                 /* Pairwise key. Get an empty slot for the key. */
 878                 if (b43_new_kidx_api(dev))
 879                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 880                 else
 881                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 882                 for (i = pairwise_keys_start;
 883                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 884                      i++) {
 885                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 886                         if (!dev->key[i].keyconf) {
 887                                 /* found empty */
 888                                 index = i;
 889                                 break;
 890                         }
 891                 }
 892                 if (index < 0) {
 893                         b43warn(dev->wl, "Out of hardware key memory\n");
 894                         return -ENOSPC;
 895                 }
 896         } else
 897                 B43_WARN_ON(index > 3);
 898
 899         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 900         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 901                 /* Default RX key */
 902                 B43_WARN_ON(mac_addr);
 903                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 904         }
 905         keyconf->hw_key_idx = index;
 906         dev->key[index].keyconf = keyconf;
 907
 908         return 0;
 909 }
 910
 911 static int b43_key_clear(struct b43_wldev *dev, int index)
 912 {
 913         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 914                 return -EINVAL;
 915         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 916                      NULL, B43_SEC_KEYSIZE, NULL);
 917         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 918                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 919                              NULL, B43_SEC_KEYSIZE, NULL);
 920         }
 921         dev->key[index].keyconf = NULL;
 922
 923         return 0;
 924 }
 925
 926 static void b43_clear_keys(struct b43_wldev *dev)
 927 {
 928         int i, count;
 929
 930         if (b43_new_kidx_api(dev))
 931                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 932         else
 933                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 934         for (i = 0; i < count; i++)
 935                 b43_key_clear(dev, i);
 936 }
 937
 938 static void b43_dump_keymemory(struct b43_wldev *dev)
 939 {
 940         unsigned int i, index, count, offset, pairwise_keys_start;
 941         u8 mac[ETH_ALEN];
 942         u16 algo;
 943         u32 rcmta0;
 944         u16 rcmta1;
 945         u64 hf;
 946         struct b43_key *key;
 947
 948         if (!b43_debug(dev, B43_DBG_KEYS))
 949                 return;
 950
 951         hf = b43_hf_read(dev);
 952         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 953                !!(hf & B43_HF_USEDEFKEYS));
 954         if (b43_new_kidx_api(dev)) {
 955                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 956                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 957         } else {
 958                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 959                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 960         }
 961         for (index = 0; index < count; index++) {
 962                 key = &(dev->key[index]);
 963                 printk(KERN_DEBUG "Key slot %02u: %s",
 964                        index, (key->keyconf == NULL) ? " " : "*");
 965                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 966                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 967                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 968                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 969                 }
 970
 971                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 972                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 973                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 974
 975                 if (index >= pairwise_keys_start) {
 976                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 977                                                 ((index - pairwise_keys_start) * 2) + 0);
 978                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 979                                                 ((index - pairwise_keys_start) * 2) + 1);
 980                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 981                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 982                         printk("   MAC: %pM", mac);
 983                 } else
 984                         printk("   DEFAULT KEY");
 985                 printk("\n");
 986         }
 987 }
 988
 989 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 990 {
 991         u32 macctl;
 992         u16 ucstat;
 993         bool hwps;
 994         bool awake;
 995         int i;
 996
 997         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 998                     (ps_flags & B43_PS_DISABLED));
 999         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1000
1001         if (ps_flags & B43_PS_ENABLED) {
1002                 hwps = 1;
1003         } else if (ps_flags & B43_PS_DISABLED) {
1004                 hwps = 0;
1005         } else {
1006                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1007                 //      and thus is not an AP and we are associated, set bit 25
1008         }
1009         if (ps_flags & B43_PS_AWAKE) {
1010                 awake = 1;
1011         } else if (ps_flags & B43_PS_ASLEEP) {
1012                 awake = 0;
1013         } else {
1014                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1015                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1016                 //      successful, set bit26
1017         }
1018
1019 /* FIXME: For now we force awake-on and hwps-off */
1020         hwps = 0;
1021         awake = 1;
1022
1023         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1024         if (hwps)
1025                 macctl |= B43_MACCTL_HWPS;
1026         else
1027                 macctl &= ~B43_MACCTL_HWPS;
1028         if (awake)
1029                 macctl |= B43_MACCTL_AWAKE;
1030         else
1031                 macctl &= ~B43_MACCTL_AWAKE;
1032         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1033         /* Commit write */
1034         b43_read32(dev, B43_MMIO_MACCTL);
1035         if (awake && dev->dev->id.revision >= 5) {
1036                 /* Wait for the microcode to wake up. */
1037                 for (i = 0; i < 100; i++) {
1038                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                                 B43_SHM_SH_UCODESTAT);
1040                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1041                                 break;
1042                         udelay(10);
1043                 }
1044         }
1045 }
1046
1047 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1048 {
1049         u32 tmslow;
1050         u32 macctl;
1051
1052         flags |= B43_TMSLOW_PHYCLKEN;
1053         flags |= B43_TMSLOW_PHYRESET;
1054         ssb_device_enable(dev->dev, flags);
1055         msleep(2);              /* Wait for the PLL to turn on. */
1056
1057         /* Now take the PHY out of Reset again */
1058         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1059         tmslow |= SSB_TMSLOW_FGC;
1060         tmslow &= ~B43_TMSLOW_PHYRESET;
1061         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1062         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1063         msleep(1);
1064         tmslow &= ~SSB_TMSLOW_FGC;
1065         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1066         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1067         msleep(1);
1068
1069         /* Turn Analog ON, but only if we already know the PHY-type.
1070          * This protects against very early setup where we don't know the
1071          * PHY-type, yet. wireless_core_reset will be called once again later,
1072          * when we know the PHY-type. */
1073         if (dev->phy.ops)
1074                 dev->phy.ops->switch_analog(dev, 1);
1075
1076         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1077         macctl &= ~B43_MACCTL_GMODE;
1078         if (flags & B43_TMSLOW_GMODE)
1079                 macctl |= B43_MACCTL_GMODE;
1080         macctl |= B43_MACCTL_IHR_ENABLED;
1081         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1082 }
1083
1084 static void handle_irq_transmit_status(struct b43_wldev *dev)
1085 {
1086         u32 v0, v1;
1087         u16 tmp;
1088         struct b43_txstatus stat;
1089
1090         while (1) {
1091                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1092                 if (!(v0 & 0x00000001))
1093                         break;
1094                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1095
1096                 stat.cookie = (v0 >> 16);
1097                 stat.seq = (v1 & 0x0000FFFF);
1098                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1099                 tmp = (v0 & 0x0000FFFF);
1100                 stat.frame_count = ((tmp & 0xF000) >> 12);
1101                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1102                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1103                 stat.pm_indicated = !!(tmp & 0x0080);
1104                 stat.intermediate = !!(tmp & 0x0040);
1105                 stat.for_ampdu = !!(tmp & 0x0020);
1106                 stat.acked = !!(tmp & 0x0002);
1107
1108                 b43_handle_txstatus(dev, &stat);
1109         }
1110 }
1111
1112 static void drain_txstatus_queue(struct b43_wldev *dev)
1113 {
1114         u32 dummy;
1115
1116         if (dev->dev->id.revision < 5)
1117                 return;
1118         /* Read all entries from the microcode TXstatus FIFO
1119          * and throw them away.
1120          */
1121         while (1) {
1122                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1123                 if (!(dummy & 0x00000001))
1124                         break;
1125                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1126         }
1127 }
1128
1129 static u32 b43_jssi_read(struct b43_wldev *dev)
1130 {
1131         u32 val = 0;
1132
1133         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1134         val <<= 16;
1135         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1136
1137         return val;
1138 }
1139
1140 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1141 {
1142         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1143         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1144 }
1145
1146 static void b43_generate_noise_sample(struct b43_wldev *dev)
1147 {
1148         b43_jssi_write(dev, 0x7F7F7F7F);
1149         b43_write32(dev, B43_MMIO_MACCMD,
1150                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1151 }
1152
1153 static void b43_calculate_link_quality(struct b43_wldev *dev)
1154 {
1155         /* Top half of Link Quality calculation. */
1156
1157         if (dev->phy.type != B43_PHYTYPE_G)
1158                 return;
1159         if (dev->noisecalc.calculation_running)
1160                 return;
1161         dev->noisecalc.calculation_running = 1;
1162         dev->noisecalc.nr_samples = 0;
1163
1164         b43_generate_noise_sample(dev);
1165 }
1166
1167 static void handle_irq_noise(struct b43_wldev *dev)
1168 {
1169         struct b43_phy_g *phy = dev->phy.g;
1170         u16 tmp;
1171         u8 noise[4];
1172         u8 i, j;
1173         s32 average;
1174
1175         /* Bottom half of Link Quality calculation. */
1176
1177         if (dev->phy.type != B43_PHYTYPE_G)
1178                 return;
1179
1180         /* Possible race condition: It might be possible that the user
1181          * changed to a different channel in the meantime since we
1182          * started the calculation. We ignore that fact, since it's
1183          * not really that much of a problem. The background noise is
1184          * an estimation only anyway. Slightly wrong results will get damped
1185          * by the averaging of the 8 sample rounds. Additionally the
1186          * value is shortlived. So it will be replaced by the next noise
1187          * calculation round soon. */
1188
1189         B43_WARN_ON(!dev->noisecalc.calculation_running);
1190         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1191         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1192             noise[2] == 0x7F || noise[3] == 0x7F)
1193                 goto generate_new;
1194
1195         /* Get the noise samples. */
1196         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1197         i = dev->noisecalc.nr_samples;
1198         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1199         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1200         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1203         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1204         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1205         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1206         dev->noisecalc.nr_samples++;
1207         if (dev->noisecalc.nr_samples == 8) {
1208                 /* Calculate the Link Quality by the noise samples. */
1209                 average = 0;
1210                 for (i = 0; i < 8; i++) {
1211                         for (j = 0; j < 4; j++)
1212                                 average += dev->noisecalc.samples[i][j];
1213                 }
1214                 average /= (8 * 4);
1215                 average *= 125;
1216                 average += 64;
1217                 average /= 128;
1218                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1219                 tmp = (tmp / 128) & 0x1F;
1220                 if (tmp >= 8)
1221                         average += 2;
1222                 else
1223                         average -= 25;
1224                 if (tmp == 8)
1225                         average -= 72;
1226                 else
1227                         average -= 48;
1228
1229                 dev->stats.link_noise = average;
1230                 dev->noisecalc.calculation_running = 0;
1231                 return;
1232         }
1233 generate_new:
1234         b43_generate_noise_sample(dev);
1235 }
1236
1237 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1238 {
1239         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1240                 ///TODO: PS TBTT
1241         } else {
1242                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1243                         b43_power_saving_ctl_bits(dev, 0);
1244         }
1245         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1246                 dev->dfq_valid = 1;
1247 }
1248
1249 static void handle_irq_atim_end(struct b43_wldev *dev)
1250 {
1251         if (dev->dfq_valid) {
1252                 b43_write32(dev, B43_MMIO_MACCMD,
1253                             b43_read32(dev, B43_MMIO_MACCMD)
1254                             | B43_MACCMD_DFQ_VALID);
1255                 dev->dfq_valid = 0;
1256         }
1257 }
1258
1259 static void handle_irq_pmq(struct b43_wldev *dev)
1260 {
1261         u32 tmp;
1262
1263         //TODO: AP mode.
1264
1265         while (1) {
1266                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1267                 if (!(tmp & 0x00000008))
1268                         break;
1269         }
1270         /* 16bit write is odd, but correct. */
1271         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1272 }
1273
1274 static void b43_write_template_common(struct b43_wldev *dev,
1275                                       const u8 *data, u16 size,
1276                                       u16 ram_offset,
1277                                       u16 shm_size_offset, u8 rate)
1278 {
1279         u32 i, tmp;
1280         struct b43_plcp_hdr4 plcp;
1281
1282         plcp.data = 0;
1283         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1284         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1285         ram_offset += sizeof(u32);
1286         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1287          * So leave the first two bytes of the next write blank.
1288          */
1289         tmp = (u32) (data[0]) << 16;
1290         tmp |= (u32) (data[1]) << 24;
1291         b43_ram_write(dev, ram_offset, tmp);
1292         ram_offset += sizeof(u32);
1293         for (i = 2; i < size; i += sizeof(u32)) {
1294                 tmp = (u32) (data[i + 0]);
1295                 if (i + 1 < size)
1296                         tmp |= (u32) (data[i + 1]) << 8;
1297                 if (i + 2 < size)
1298                         tmp |= (u32) (data[i + 2]) << 16;
1299                 if (i + 3 < size)
1300                         tmp |= (u32) (data[i + 3]) << 24;
1301                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1302         }
1303         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1304                         size + sizeof(struct b43_plcp_hdr6));
1305 }
1306
1307 /* Check if the use of the antenna that ieee80211 told us to
1308  * use is possible. This will fall back to DEFAULT.
1309  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1310 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1311                                   u8 antenna_nr)
1312 {
1313         u8 antenna_mask;
1314
1315         if (antenna_nr == 0) {
1316                 /* Zero means "use default antenna". That's always OK. */
1317                 return 0;
1318         }
1319
1320         /* Get the mask of available antennas. */
1321         if (dev->phy.gmode)
1322                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1323         else
1324                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1325
1326         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1327                 /* This antenna is not available. Fall back to default. */
1328                 return 0;
1329         }
1330
1331         return antenna_nr;
1332 }
1333
1334 /* Convert a b43 antenna number value to the PHY TX control value. */
1335 static u16 b43_antenna_to_phyctl(int antenna)
1336 {
1337         switch (antenna) {
1338         case B43_ANTENNA0:
1339                 return B43_TXH_PHY_ANT0;
1340         case B43_ANTENNA1:
1341                 return B43_TXH_PHY_ANT1;
1342         case B43_ANTENNA2:
1343                 return B43_TXH_PHY_ANT2;
1344         case B43_ANTENNA3:
1345                 return B43_TXH_PHY_ANT3;
1346         case B43_ANTENNA_AUTO:
1347                 return B43_TXH_PHY_ANT01AUTO;
1348         }
1349         B43_WARN_ON(1);
1350         return 0;
1351 }
1352
1353 static void b43_write_beacon_template(struct b43_wldev *dev,
1354                                       u16 ram_offset,
1355                                       u16 shm_size_offset)
1356 {
1357         unsigned int i, len, variable_len;
1358         const struct ieee80211_mgmt *bcn;
1359         const u8 *ie;
1360         bool tim_found = 0;
1361         unsigned int rate;
1362         u16 ctl;
1363         int antenna;
1364         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1365
1366         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1367         len = min((size_t) dev->wl->current_beacon->len,
1368                   0x200 - sizeof(struct b43_plcp_hdr6));
1369         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1370
1371         b43_write_template_common(dev, (const u8 *)bcn,
1372                                   len, ram_offset, shm_size_offset, rate);
1373
1374         /* Write the PHY TX control parameters. */
1375         antenna = B43_ANTENNA_DEFAULT;
1376         antenna = b43_antenna_to_phyctl(antenna);
1377         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1378         /* We can't send beacons with short preamble. Would get PHY errors. */
1379         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1380         ctl &= ~B43_TXH_PHY_ANT;
1381         ctl &= ~B43_TXH_PHY_ENC;
1382         ctl |= antenna;
1383         if (b43_is_cck_rate(rate))
1384                 ctl |= B43_TXH_PHY_ENC_CCK;
1385         else
1386                 ctl |= B43_TXH_PHY_ENC_OFDM;
1387         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1388
1389         /* Find the position of the TIM and the DTIM_period value
1390          * and write them to SHM. */
1391         ie = bcn->u.beacon.variable;
1392         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1393         for (i = 0; i < variable_len - 2; ) {
1394                 uint8_t ie_id, ie_len;
1395
1396                 ie_id = ie[i];
1397                 ie_len = ie[i + 1];
1398                 if (ie_id == 5) {
1399                         u16 tim_position;
1400                         u16 dtim_period;
1401                         /* This is the TIM Information Element */
1402
1403                         /* Check whether the ie_len is in the beacon data range. */
1404                         if (variable_len < ie_len + 2 + i)
1405                                 break;
1406                         /* A valid TIM is at least 4 bytes long. */
1407                         if (ie_len < 4)
1408                                 break;
1409                         tim_found = 1;
1410
1411                         tim_position = sizeof(struct b43_plcp_hdr6);
1412                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1413                         tim_position += i;
1414
1415                         dtim_period = ie[i + 3];
1416
1417                         b43_shm_write16(dev, B43_SHM_SHARED,
1418                                         B43_SHM_SH_TIMBPOS, tim_position);
1419                         b43_shm_write16(dev, B43_SHM_SHARED,
1420                                         B43_SHM_SH_DTIMPER, dtim_period);
1421                         break;
1422                 }
1423                 i += ie_len + 2;
1424         }
1425         if (!tim_found) {
1426                 /*
1427                  * If ucode wants to modify TIM do it behind the beacon, this
1428                  * will happen, for example, when doing mesh networking.
1429                  */
1430                 b43_shm_write16(dev, B43_SHM_SHARED,
1431                                 B43_SHM_SH_TIMBPOS,
1432                                 len + sizeof(struct b43_plcp_hdr6));
1433                 b43_shm_write16(dev, B43_SHM_SHARED,
1434                                 B43_SHM_SH_DTIMPER, 0);
1435         }
1436         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1437 }
1438
1439 static void b43_upload_beacon0(struct b43_wldev *dev)
1440 {
1441         struct b43_wl *wl = dev->wl;
1442
1443         if (wl->beacon0_uploaded)
1444                 return;
1445         b43_write_beacon_template(dev, 0x68, 0x18);
1446         wl->beacon0_uploaded = 1;
1447 }
1448
1449 static void b43_upload_beacon1(struct b43_wldev *dev)
1450 {
1451         struct b43_wl *wl = dev->wl;
1452
1453         if (wl->beacon1_uploaded)
1454                 return;
1455         b43_write_beacon_template(dev, 0x468, 0x1A);
1456         wl->beacon1_uploaded = 1;
1457 }
1458
1459 static void handle_irq_beacon(struct b43_wldev *dev)
1460 {
1461         struct b43_wl *wl = dev->wl;
1462         u32 cmd, beacon0_valid, beacon1_valid;
1463
1464         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1465             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1466                 return;
1467
1468         /* This is the bottom half of the asynchronous beacon update. */
1469
1470         /* Ignore interrupt in the future. */
1471         dev->irq_mask &= ~B43_IRQ_BEACON;
1472
1473         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1474         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1475         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1476
1477         /* Schedule interrupt manually, if busy. */
1478         if (beacon0_valid && beacon1_valid) {
1479                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1480                 dev->irq_mask |= B43_IRQ_BEACON;
1481                 return;
1482         }
1483
1484         if (unlikely(wl->beacon_templates_virgin)) {
1485                 /* We never uploaded a beacon before.
1486                  * Upload both templates now, but only mark one valid. */
1487                 wl->beacon_templates_virgin = 0;
1488                 b43_upload_beacon0(dev);
1489                 b43_upload_beacon1(dev);
1490                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1491                 cmd |= B43_MACCMD_BEACON0_VALID;
1492                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1493         } else {
1494                 if (!beacon0_valid) {
1495                         b43_upload_beacon0(dev);
1496                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1497                         cmd |= B43_MACCMD_BEACON0_VALID;
1498                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1499                 } else if (!beacon1_valid) {
1500                         b43_upload_beacon1(dev);
1501                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1502                         cmd |= B43_MACCMD_BEACON1_VALID;
1503                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1504                 }
1505         }
1506 }
1507
1508 static void b43_beacon_update_trigger_work(struct work_struct *work)
1509 {
1510         struct b43_wl *wl = container_of(work, struct b43_wl,
1511                                          beacon_update_trigger);
1512         struct b43_wldev *dev;
1513
1514         mutex_lock(&wl->mutex);
1515         dev = wl->current_dev;
1516         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1517                 spin_lock_irq(&wl->irq_lock);
1518                 /* update beacon right away or defer to irq */
1519                 handle_irq_beacon(dev);
1520                 /* The handler might have updated the IRQ mask. */
1521                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1522                 mmiowb();
1523                 spin_unlock_irq(&wl->irq_lock);
1524         }
1525         mutex_unlock(&wl->mutex);
1526 }
1527
1528 /* Asynchronously update the packet templates in template RAM.
1529  * Locking: Requires wl->irq_lock to be locked. */
1530 static void b43_update_templates(struct b43_wl *wl)
1531 {
1532         struct sk_buff *beacon;
1533
1534         /* This is the top half of the ansynchronous beacon update.
1535          * The bottom half is the beacon IRQ.
1536          * Beacon update must be asynchronous to avoid sending an
1537          * invalid beacon. This can happen for example, if the firmware
1538          * transmits a beacon while we are updating it. */
1539
1540         /* We could modify the existing beacon and set the aid bit in
1541          * the TIM field, but that would probably require resizing and
1542          * moving of data within the beacon template.
1543          * Simply request a new beacon and let mac80211 do the hard work. */
1544         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1545         if (unlikely(!beacon))
1546                 return;
1547
1548         if (wl->current_beacon)
1549                 dev_kfree_skb_any(wl->current_beacon);
1550         wl->current_beacon = beacon;
1551         wl->beacon0_uploaded = 0;
1552         wl->beacon1_uploaded = 0;
1553         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1554 }
1555
1556 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1557 {
1558         b43_time_lock(dev);
1559         if (dev->dev->id.revision >= 3) {
1560                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1561                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1562         } else {
1563                 b43_write16(dev, 0x606, (beacon_int >> 6));
1564                 b43_write16(dev, 0x610, beacon_int);
1565         }
1566         b43_time_unlock(dev);
1567         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1568 }
1569
1570 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1571 {
1572         u16 reason;
1573
1574         /* Read the register that contains the reason code for the panic. */
1575         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1576         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1577
1578         switch (reason) {
1579         default:
1580                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1581                 /* fallthrough */
1582         case B43_FWPANIC_DIE:
1583                 /* Do not restart the controller or firmware.
1584                  * The device is nonfunctional from now on.
1585                  * Restarting would result in this panic to trigger again,
1586                  * so we avoid that recursion. */
1587                 break;
1588         case B43_FWPANIC_RESTART:
1589                 b43_controller_restart(dev, "Microcode panic");
1590                 break;
1591         }
1592 }
1593
1594 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1595 {
1596         unsigned int i, cnt;
1597         u16 reason, marker_id, marker_line;
1598         __le16 *buf;
1599
1600         /* The proprietary firmware doesn't have this IRQ. */
1601         if (!dev->fw.opensource)
1602                 return;
1603
1604         /* Read the register that contains the reason code for this IRQ. */
1605         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1606
1607         switch (reason) {
1608         case B43_DEBUGIRQ_PANIC:
1609                 b43_handle_firmware_panic(dev);
1610                 break;
1611         case B43_DEBUGIRQ_DUMP_SHM:
1612                 if (!B43_DEBUG)
1613                         break; /* Only with driver debugging enabled. */
1614                 buf = kmalloc(4096, GFP_ATOMIC);
1615                 if (!buf) {
1616                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1617                         goto out;
1618                 }
1619                 for (i = 0; i < 4096; i += 2) {
1620                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1621                         buf[i / 2] = cpu_to_le16(tmp);
1622                 }
1623                 b43info(dev->wl, "Shared memory dump:\n");
1624                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1625                                16, 2, buf, 4096, 1);
1626                 kfree(buf);
1627                 break;
1628         case B43_DEBUGIRQ_DUMP_REGS:
1629                 if (!B43_DEBUG)
1630                         break; /* Only with driver debugging enabled. */
1631                 b43info(dev->wl, "Microcode register dump:\n");
1632                 for (i = 0, cnt = 0; i < 64; i++) {
1633                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1634                         if (cnt == 0)
1635                                 printk(KERN_INFO);
1636                         printk("r%02u: 0x%04X  ", i, tmp);
1637                         cnt++;
1638                         if (cnt == 6) {
1639                                 printk("\n");
1640                                 cnt = 0;
1641                         }
1642                 }
1643                 printk("\n");
1644                 break;
1645         case B43_DEBUGIRQ_MARKER:
1646                 if (!B43_DEBUG)
1647                         break; /* Only with driver debugging enabled. */
1648                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1649                                            B43_MARKER_ID_REG);
1650                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1651                                              B43_MARKER_LINE_REG);
1652                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1653                         "at line number %u\n",
1654                         marker_id, marker_line);
1655                 break;
1656         default:
1657                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1658                        reason);
1659         }
1660 out:
1661         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1662         b43_shm_write16(dev, B43_SHM_SCRATCH,
1663                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1664 }
1665
1666 /* Interrupt handler bottom-half */
1667 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1668 {
1669         u32 reason;
1670         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1671         u32 merged_dma_reason = 0;
1672         int i;
1673         unsigned long flags;
1674
1675         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1676
1677         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1678
1679         reason = dev->irq_reason;
1680         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1681                 dma_reason[i] = dev->dma_reason[i];
1682                 merged_dma_reason |= dma_reason[i];
1683         }
1684
1685         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1686                 b43err(dev->wl, "MAC transmission error\n");
1687
1688         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1689                 b43err(dev->wl, "PHY transmission error\n");
1690                 rmb();
1691                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1692                         atomic_set(&dev->phy.txerr_cnt,
1693                                    B43_PHY_TX_BADNESS_LIMIT);
1694                         b43err(dev->wl, "Too many PHY TX errors, "
1695                                         "restarting the controller\n");
1696                         b43_controller_restart(dev, "PHY TX errors");
1697                 }
1698         }
1699
1700         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1701                                           B43_DMAIRQ_NONFATALMASK))) {
1702                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1703                         b43err(dev->wl, "Fatal DMA error: "
1704                                "0x%08X, 0x%08X, 0x%08X, "
1705                                "0x%08X, 0x%08X, 0x%08X\n",
1706                                dma_reason[0], dma_reason[1],
1707                                dma_reason[2], dma_reason[3],
1708                                dma_reason[4], dma_reason[5]);
1709                         b43_controller_restart(dev, "DMA error");
1710                         mmiowb();
1711                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1712                         return;
1713                 }
1714                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1715                         b43err(dev->wl, "DMA error: "
1716                                "0x%08X, 0x%08X, 0x%08X, "
1717                                "0x%08X, 0x%08X, 0x%08X\n",
1718                                dma_reason[0], dma_reason[1],
1719                                dma_reason[2], dma_reason[3],
1720                                dma_reason[4], dma_reason[5]);
1721                 }
1722         }
1723
1724         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1725                 handle_irq_ucode_debug(dev);
1726         if (reason & B43_IRQ_TBTT_INDI)
1727                 handle_irq_tbtt_indication(dev);
1728         if (reason & B43_IRQ_ATIM_END)
1729                 handle_irq_atim_end(dev);
1730         if (reason & B43_IRQ_BEACON)
1731                 handle_irq_beacon(dev);
1732         if (reason & B43_IRQ_PMQ)
1733                 handle_irq_pmq(dev);
1734         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1735                 ;/* TODO */
1736         if (reason & B43_IRQ_NOISESAMPLE_OK)
1737                 handle_irq_noise(dev);
1738
1739         /* Check the DMA reason registers for received data. */
1740         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1741                 if (b43_using_pio_transfers(dev))
1742                         b43_pio_rx(dev->pio.rx_queue);
1743                 else
1744                         b43_dma_rx(dev->dma.rx_ring);
1745         }
1746         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1747         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1748         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1749         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1750         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1751
1752         if (reason & B43_IRQ_TX_OK)
1753                 handle_irq_transmit_status(dev);
1754
1755         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1756         mmiowb();
1757         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1758 }
1759
1760 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1761 {
1762         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1763
1764         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1765         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1766         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1767         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1768         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1769 /* Unused ring
1770         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1771 */
1772 }
1773
1774 /* Interrupt handler top-half */
1775 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1776 {
1777         irqreturn_t ret = IRQ_NONE;
1778         struct b43_wldev *dev = dev_id;
1779         u32 reason;
1780
1781         B43_WARN_ON(!dev);
1782
1783         spin_lock(&dev->wl->irq_lock);
1784
1785         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1786                 /* This can only happen on shared IRQ lines. */
1787                 goto out;
1788         }
1789         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1790         if (reason == 0xffffffff)       /* shared IRQ */
1791                 goto out;
1792         ret = IRQ_HANDLED;
1793         reason &= dev->irq_mask;
1794         if (!reason)
1795                 goto out;
1796
1797         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1798             & 0x0001DC00;
1799         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1800             & 0x0000DC00;
1801         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1802             & 0x0000DC00;
1803         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1804             & 0x0001DC00;
1805         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1806             & 0x0000DC00;
1807 /* Unused ring
1808         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1809             & 0x0000DC00;
1810 */
1811
1812         b43_interrupt_ack(dev, reason);
1813         /* disable all IRQs. They are enabled again in the bottom half. */
1814         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1815         /* save the reason code and call our bottom half. */
1816         dev->irq_reason = reason;
1817         tasklet_schedule(&dev->isr_tasklet);
1818 out:
1819         mmiowb();
1820         spin_unlock(&dev->wl->irq_lock);
1821
1822         return ret;
1823 }
1824
1825 void b43_do_release_fw(struct b43_firmware_file *fw)
1826 {
1827         release_firmware(fw->data);
1828         fw->data = NULL;
1829         fw->filename = NULL;
1830 }
1831
1832 static void b43_release_firmware(struct b43_wldev *dev)
1833 {
1834         b43_do_release_fw(&dev->fw.ucode);
1835         b43_do_release_fw(&dev->fw.pcm);
1836         b43_do_release_fw(&dev->fw.initvals);
1837         b43_do_release_fw(&dev->fw.initvals_band);
1838 }
1839
1840 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1841 {
1842         const char text[] =
1843                 "You must go to " \
1844                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1845                 "and download the correct firmware for this driver version. " \
1846                 "Please carefully read all instructions on this website.\n";
1847
1848         if (error)
1849                 b43err(wl, text);
1850         else
1851                 b43warn(wl, text);
1852 }
1853
1854 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1855                       const char *name,
1856                       struct b43_firmware_file *fw)
1857 {
1858         const struct firmware *blob;
1859         struct b43_fw_header *hdr;
1860         u32 size;
1861         int err;
1862
1863         if (!name) {
1864                 /* Don't fetch anything. Free possibly cached firmware. */
1865                 /* FIXME: We should probably keep it anyway, to save some headache
1866                  * on suspend/resume with multiband devices. */
1867                 b43_do_release_fw(fw);
1868                 return 0;
1869         }
1870         if (fw->filename) {
1871                 if ((fw->type == ctx->req_type) &&
1872                     (strcmp(fw->filename, name) == 0))
1873                         return 0; /* Already have this fw. */
1874                 /* Free the cached firmware first. */
1875                 /* FIXME: We should probably do this later after we successfully
1876                  * got the new fw. This could reduce headache with multiband devices.
1877                  * We could also redesign this to cache the firmware for all possible
1878                  * bands all the time. */
1879                 b43_do_release_fw(fw);
1880         }
1881
1882         switch (ctx->req_type) {
1883         case B43_FWTYPE_PROPRIETARY:
1884                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1885                          "b43%s/%s.fw",
1886                          modparam_fwpostfix, name);
1887                 break;
1888         case B43_FWTYPE_OPENSOURCE:
1889                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1890                          "b43-open%s/%s.fw",
1891                          modparam_fwpostfix, name);
1892                 break;
1893         default:
1894                 B43_WARN_ON(1);
1895                 return -ENOSYS;
1896         }
1897         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
1898         if (err == -ENOENT) {
1899                 snprintf(ctx->errors[ctx->req_type],
1900                          sizeof(ctx->errors[ctx->req_type]),
1901                          "Firmware file \"%s\" not found\n", ctx->fwname);
1902                 return err;
1903         } else if (err) {
1904                 snprintf(ctx->errors[ctx->req_type],
1905                          sizeof(ctx->errors[ctx->req_type]),
1906                          "Firmware file \"%s\" request failed (err=%d)\n",
1907                          ctx->fwname, err);
1908                 return err;
1909         }
1910         if (blob->size < sizeof(struct b43_fw_header))
1911                 goto err_format;
1912         hdr = (struct b43_fw_header *)(blob->data);
1913         switch (hdr->type) {
1914         case B43_FW_TYPE_UCODE:
1915         case B43_FW_TYPE_PCM:
1916                 size = be32_to_cpu(hdr->size);
1917                 if (size != blob->size - sizeof(struct b43_fw_header))
1918                         goto err_format;
1919                 /* fallthrough */
1920         case B43_FW_TYPE_IV:
1921                 if (hdr->ver != 1)
1922                         goto err_format;
1923                 break;
1924         default:
1925                 goto err_format;
1926         }
1927
1928         fw->data = blob;
1929         fw->filename = name;
1930         fw->type = ctx->req_type;
1931
1932         return 0;
1933
1934 err_format:
1935         snprintf(ctx->errors[ctx->req_type],
1936                  sizeof(ctx->errors[ctx->req_type]),
1937                  "Firmware file \"%s\" format error.\n", ctx->fwname);
1938         release_firmware(blob);
1939
1940         return -EPROTO;
1941 }
1942
1943 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
1944 {
1945         struct b43_wldev *dev = ctx->dev;
1946         struct b43_firmware *fw = &ctx->dev->fw;
1947         const u8 rev = ctx->dev->dev->id.revision;
1948         const char *filename;
1949         u32 tmshigh;
1950         int err;
1951
1952         /* Get microcode */
1953         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1954         if ((rev >= 5) && (rev <= 10))
1955                 filename = "ucode5";
1956         else if ((rev >= 11) && (rev <= 12))
1957                 filename = "ucode11";
1958         else if (rev == 13)
1959                 filename = "ucode13";
1960         else if (rev == 14)
1961                 filename = "ucode14";
1962         else if (rev >= 15)
1963                 filename = "ucode15";
1964         else
1965                 goto err_no_ucode;
1966         err = b43_do_request_fw(ctx, filename, &fw->ucode);
1967         if (err)
1968                 goto err_load;
1969
1970         /* Get PCM code */
1971         if ((rev >= 5) && (rev <= 10))
1972                 filename = "pcm5";
1973         else if (rev >= 11)
1974                 filename = NULL;
1975         else
1976                 goto err_no_pcm;
1977         fw->pcm_request_failed = 0;
1978         err = b43_do_request_fw(ctx, filename, &fw->pcm);
1979         if (err == -ENOENT) {
1980                 /* We did not find a PCM file? Not fatal, but
1981                  * core rev <= 10 must do without hwcrypto then. */
1982                 fw->pcm_request_failed = 1;
1983         } else if (err)
1984                 goto err_load;
1985
1986         /* Get initvals */
1987         switch (dev->phy.type) {
1988         case B43_PHYTYPE_A:
1989                 if ((rev >= 5) && (rev <= 10)) {
1990                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1991                                 filename = "a0g1initvals5";
1992                         else
1993                                 filename = "a0g0initvals5";
1994                 } else
1995                         goto err_no_initvals;
1996                 break;
1997         case B43_PHYTYPE_G:
1998                 if ((rev >= 5) && (rev <= 10))
1999                         filename = "b0g0initvals5";
2000                 else if (rev >= 13)
2001                         filename = "b0g0initvals13";
2002                 else
2003                         goto err_no_initvals;
2004                 break;
2005         case B43_PHYTYPE_N:
2006                 if ((rev >= 11) && (rev <= 12))
2007                         filename = "n0initvals11";
2008                 else
2009                         goto err_no_initvals;
2010                 break;
2011         case B43_PHYTYPE_LP:
2012                 if (rev == 13)
2013                         filename = "lp0initvals13";
2014                 else if (rev == 14)
2015                         filename = "lp0initvals14";
2016                 else if (rev >= 15)
2017                         filename = "lp0initvals15";
2018                 else
2019                         goto err_no_initvals;
2020                 break;
2021         default:
2022                 goto err_no_initvals;
2023         }
2024         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2025         if (err)
2026                 goto err_load;
2027
2028         /* Get bandswitch initvals */
2029         switch (dev->phy.type) {
2030         case B43_PHYTYPE_A:
2031                 if ((rev >= 5) && (rev <= 10)) {
2032                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2033                                 filename = "a0g1bsinitvals5";
2034                         else
2035                                 filename = "a0g0bsinitvals5";
2036                 } else if (rev >= 11)
2037                         filename = NULL;
2038                 else
2039                         goto err_no_initvals;
2040                 break;
2041         case B43_PHYTYPE_G:
2042                 if ((rev >= 5) && (rev <= 10))
2043                         filename = "b0g0bsinitvals5";
2044                 else if (rev >= 11)
2045                         filename = NULL;
2046                 else
2047                         goto err_no_initvals;
2048                 break;
2049         case B43_PHYTYPE_N:
2050                 if ((rev >= 11) && (rev <= 12))
2051                         filename = "n0bsinitvals11";
2052                 else
2053                         goto err_no_initvals;
2054                 break;
2055         case B43_PHYTYPE_LP:
2056                 if (rev == 13)
2057                         filename = "lp0bsinitvals13";
2058                 else if (rev == 14)
2059                         filename = "lp0bsinitvals14";
2060                 else if (rev >= 15)
2061                         filename = "lp0bsinitvals15";
2062                 else
2063                         goto err_no_initvals;
2064                 break;
2065         default:
2066                 goto err_no_initvals;
2067         }
2068         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2069         if (err)
2070                 goto err_load;
2071
2072         return 0;
2073
2074 err_no_ucode:
2075         err = ctx->fatal_failure = -EOPNOTSUPP;
2076         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2077                "is required for your device (wl-core rev %u)\n", rev);
2078         goto error;
2079
2080 err_no_pcm:
2081         err = ctx->fatal_failure = -EOPNOTSUPP;
2082         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2083                "is required for your device (wl-core rev %u)\n", rev);
2084         goto error;
2085
2086 err_no_initvals:
2087         err = ctx->fatal_failure = -EOPNOTSUPP;
2088         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2089                "is required for your device (wl-core rev %u)\n", rev);
2090         goto error;
2091
2092 err_load:
2093         /* We failed to load this firmware image. The error message
2094          * already is in ctx->errors. Return and let our caller decide
2095          * what to do. */
2096         goto error;
2097
2098 error:
2099         b43_release_firmware(dev);
2100         return err;
2101 }
2102
2103 static int b43_request_firmware(struct b43_wldev *dev)
2104 {
2105         struct b43_request_fw_context *ctx;
2106         unsigned int i;
2107         int err;
2108         const char *errmsg;
2109
2110         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2111         if (!ctx)
2112                 return -ENOMEM;
2113         ctx->dev = dev;
2114
2115         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2116         err = b43_try_request_fw(ctx);
2117         if (!err)
2118                 goto out; /* Successfully loaded it. */
2119         err = ctx->fatal_failure;
2120         if (err)
2121                 goto out;
2122
2123         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2124         err = b43_try_request_fw(ctx);
2125         if (!err)
2126                 goto out; /* Successfully loaded it. */
2127         err = ctx->fatal_failure;
2128         if (err)
2129                 goto out;
2130
2131         /* Could not find a usable firmware. Print the errors. */
2132         for (i = 0; i < B43_NR_FWTYPES; i++) {
2133                 errmsg = ctx->errors[i];
2134                 if (strlen(errmsg))
2135                         b43err(dev->wl, errmsg);
2136         }
2137         b43_print_fw_helptext(dev->wl, 1);
2138         err = -ENOENT;
2139
2140 out:
2141         kfree(ctx);
2142         return err;
2143 }
2144
2145 static int b43_upload_microcode(struct b43_wldev *dev)
2146 {
2147         const size_t hdr_len = sizeof(struct b43_fw_header);
2148         const __be32 *data;
2149         unsigned int i, len;
2150         u16 fwrev, fwpatch, fwdate, fwtime;
2151         u32 tmp, macctl;
2152         int err = 0;
2153
2154         /* Jump the microcode PSM to offset 0 */
2155         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2156         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2157         macctl |= B43_MACCTL_PSM_JMP0;
2158         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2159         /* Zero out all microcode PSM registers and shared memory. */
2160         for (i = 0; i < 64; i++)
2161                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2162         for (i = 0; i < 4096; i += 2)
2163                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2164
2165         /* Upload Microcode. */
2166         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2167         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2168         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2169         for (i = 0; i < len; i++) {
2170                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2171                 udelay(10);
2172         }
2173
2174         if (dev->fw.pcm.data) {
2175                 /* Upload PCM data. */
2176                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2177                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2178                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2179                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2180                 /* No need for autoinc bit in SHM_HW */
2181                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2182                 for (i = 0; i < len; i++) {
2183                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2184                         udelay(10);
2185                 }
2186         }
2187
2188         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2189
2190         /* Start the microcode PSM */
2191         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2192         macctl &= ~B43_MACCTL_PSM_JMP0;
2193         macctl |= B43_MACCTL_PSM_RUN;
2194         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2195
2196         /* Wait for the microcode to load and respond */
2197         i = 0;
2198         while (1) {
2199                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2200                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2201                         break;
2202                 i++;
2203                 if (i >= 20) {
2204                         b43err(dev->wl, "Microcode not responding\n");
2205                         b43_print_fw_helptext(dev->wl, 1);
2206                         err = -ENODEV;
2207                         goto error;
2208                 }
2209                 msleep_interruptible(50);
2210                 if (signal_pending(current)) {
2211                         err = -EINTR;
2212                         goto error;
2213                 }
2214         }
2215         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2216
2217         /* Get and check the revisions. */
2218         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2219         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2220         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2221         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2222
2223         if (fwrev <= 0x128) {
2224                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2225                        "binary drivers older than version 4.x is unsupported. "
2226                        "You must upgrade your firmware files.\n");
2227                 b43_print_fw_helptext(dev->wl, 1);
2228                 err = -EOPNOTSUPP;
2229                 goto error;
2230         }
2231         dev->fw.rev = fwrev;
2232         dev->fw.patch = fwpatch;
2233         dev->fw.opensource = (fwdate == 0xFFFF);
2234
2235         /* Default to use-all-queues. */
2236         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2237         dev->qos_enabled = !!modparam_qos;
2238         /* Default to firmware/hardware crypto acceleration. */
2239         dev->hwcrypto_enabled = 1;
2240
2241         if (dev->fw.opensource) {
2242                 u16 fwcapa;
2243
2244                 /* Patchlevel info is encoded in the "time" field. */
2245                 dev->fw.patch = fwtime;
2246                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2247                         dev->fw.rev, dev->fw.patch);
2248
2249                 fwcapa = b43_fwcapa_read(dev);
2250                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2251                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2252                         /* Disable hardware crypto and fall back to software crypto. */
2253                         dev->hwcrypto_enabled = 0;
2254                 }
2255                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2256                         b43info(dev->wl, "QoS not supported by firmware\n");
2257                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2258                          * ieee80211_unregister to make sure the networking core can
2259                          * properly free possible resources. */
2260                         dev->wl->hw->queues = 1;
2261                         dev->qos_enabled = 0;
2262                 }
2263         } else {
2264                 b43info(dev->wl, "Loading firmware version %u.%u "
2265                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2266                         fwrev, fwpatch,
2267                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2268                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2269                 if (dev->fw.pcm_request_failed) {
2270                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2271                                 "Hardware accelerated cryptography is disabled.\n");
2272                         b43_print_fw_helptext(dev->wl, 0);
2273                 }
2274         }
2275
2276         if (b43_is_old_txhdr_format(dev)) {
2277                 /* We're over the deadline, but we keep support for old fw
2278                  * until it turns out to be in major conflict with something new. */
2279                 b43warn(dev->wl, "You are using an old firmware image. "
2280                         "Support for old firmware will be removed soon "
2281                         "(official deadline was July 2008).\n");
2282                 b43_print_fw_helptext(dev->wl, 0);
2283         }
2284
2285         return 0;
2286
2287 error:
2288         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2289         macctl &= ~B43_MACCTL_PSM_RUN;
2290         macctl |= B43_MACCTL_PSM_JMP0;
2291         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2292
2293         return err;
2294 }
2295
2296 static int b43_write_initvals(struct b43_wldev *dev,
2297                               const struct b43_iv *ivals,
2298                               size_t count,
2299                               size_t array_size)
2300 {
2301         const struct b43_iv *iv;
2302         u16 offset;
2303         size_t i;
2304         bool bit32;
2305
2306         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2307         iv = ivals;
2308         for (i = 0; i < count; i++) {
2309                 if (array_size < sizeof(iv->offset_size))
2310                         goto err_format;
2311                 array_size -= sizeof(iv->offset_size);
2312                 offset = be16_to_cpu(iv->offset_size);
2313                 bit32 = !!(offset & B43_IV_32BIT);
2314                 offset &= B43_IV_OFFSET_MASK;
2315                 if (offset >= 0x1000)
2316                         goto err_format;
2317                 if (bit32) {
2318                         u32 value;
2319
2320                         if (array_size < sizeof(iv->data.d32))
2321                                 goto err_format;
2322                         array_size -= sizeof(iv->data.d32);
2323
2324                         value = get_unaligned_be32(&iv->data.d32);
2325                         b43_write32(dev, offset, value);
2326
2327                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2328                                                         sizeof(__be16) +
2329                                                         sizeof(__be32));
2330                 } else {
2331                         u16 value;
2332
2333                         if (array_size < sizeof(iv->data.d16))
2334                                 goto err_format;
2335                         array_size -= sizeof(iv->data.d16);
2336
2337                         value = be16_to_cpu(iv->data.d16);
2338                         b43_write16(dev, offset, value);
2339
2340                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2341                                                         sizeof(__be16) +
2342                                                         sizeof(__be16));
2343                 }
2344         }
2345         if (array_size)
2346                 goto err_format;
2347
2348         return 0;
2349
2350 err_format:
2351         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2352         b43_print_fw_helptext(dev->wl, 1);
2353
2354         return -EPROTO;
2355 }
2356
2357 static int b43_upload_initvals(struct b43_wldev *dev)
2358 {
2359         const size_t hdr_len = sizeof(struct b43_fw_header);
2360         const struct b43_fw_header *hdr;
2361         struct b43_firmware *fw = &dev->fw;
2362         const struct b43_iv *ivals;
2363         size_t count;
2364         int err;
2365
2366         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2367         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2368         count = be32_to_cpu(hdr->size);
2369         err = b43_write_initvals(dev, ivals, count,
2370                                  fw->initvals.data->size - hdr_len);
2371         if (err)
2372                 goto out;
2373         if (fw->initvals_band.data) {
2374                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2375                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2376                 count = be32_to_cpu(hdr->size);
2377                 err = b43_write_initvals(dev, ivals, count,
2378                                          fw->initvals_band.data->size - hdr_len);
2379                 if (err)
2380                         goto out;
2381         }
2382 out:
2383
2384         return err;
2385 }
2386
2387 /* Initialize the GPIOs
2388  * http://bcm-specs.sipsolutions.net/GPIO
2389  */
2390 static int b43_gpio_init(struct b43_wldev *dev)
2391 {
2392         struct ssb_bus *bus = dev->dev->bus;
2393         struct ssb_device *gpiodev, *pcidev = NULL;
2394         u32 mask, set;
2395
2396         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2397                     & ~B43_MACCTL_GPOUTSMSK);
2398
2399         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2400                     | 0x000F);
2401
2402         mask = 0x0000001F;
2403         set = 0x0000000F;
2404         if (dev->dev->bus->chip_id == 0x4301) {
2405                 mask |= 0x0060;
2406                 set |= 0x0060;
2407         }
2408         if (0 /* FIXME: conditional unknown */ ) {
2409                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2410                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2411                             | 0x0100);
2412                 mask |= 0x0180;
2413                 set |= 0x0180;
2414         }
2415         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2416                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2417                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2418                             | 0x0200);
2419                 mask |= 0x0200;
2420                 set |= 0x0200;
2421         }
2422         if (dev->dev->id.revision >= 2)
2423                 mask |= 0x0010; /* FIXME: This is redundant. */
2424
2425 #ifdef CONFIG_SSB_DRIVER_PCICORE
2426         pcidev = bus->pcicore.dev;
2427 #endif
2428         gpiodev = bus->chipco.dev ? : pcidev;
2429         if (!gpiodev)
2430                 return 0;
2431         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2432                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2433                      & mask) | set);
2434
2435         return 0;
2436 }
2437
2438 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2439 static void b43_gpio_cleanup(struct b43_wldev *dev)
2440 {
2441         struct ssb_bus *bus = dev->dev->bus;
2442         struct ssb_device *gpiodev, *pcidev = NULL;
2443
2444 #ifdef CONFIG_SSB_DRIVER_PCICORE
2445         pcidev = bus->pcicore.dev;
2446 #endif
2447         gpiodev = bus->chipco.dev ? : pcidev;
2448         if (!gpiodev)
2449                 return;
2450         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2451 }
2452
2453 /* http://bcm-specs.sipsolutions.net/EnableMac */
2454 void b43_mac_enable(struct b43_wldev *dev)
2455 {
2456         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2457                 u16 fwstate;
2458
2459                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2460                                          B43_SHM_SH_UCODESTAT);
2461                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2462                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2463                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2464                                "should be suspended, but current state is %u\n",
2465                                fwstate);
2466                 }
2467         }
2468
2469         dev->mac_suspended--;
2470         B43_WARN_ON(dev->mac_suspended < 0);
2471         if (dev->mac_suspended == 0) {
2472                 b43_write32(dev, B43_MMIO_MACCTL,
2473                             b43_read32(dev, B43_MMIO_MACCTL)
2474                             | B43_MACCTL_ENABLED);
2475                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2476                             B43_IRQ_MAC_SUSPENDED);
2477                 /* Commit writes */
2478                 b43_read32(dev, B43_MMIO_MACCTL);
2479                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2480                 b43_power_saving_ctl_bits(dev, 0);
2481         }
2482 }
2483
2484 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2485 void b43_mac_suspend(struct b43_wldev *dev)
2486 {
2487         int i;
2488         u32 tmp;
2489
2490         might_sleep();
2491         B43_WARN_ON(dev->mac_suspended < 0);
2492
2493         if (dev->mac_suspended == 0) {
2494                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2495                 b43_write32(dev, B43_MMIO_MACCTL,
2496                             b43_read32(dev, B43_MMIO_MACCTL)
2497                             & ~B43_MACCTL_ENABLED);
2498                 /* force pci to flush the write */
2499                 b43_read32(dev, B43_MMIO_MACCTL);
2500                 for (i = 35; i; i--) {
2501                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2502                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2503                                 goto out;
2504                         udelay(10);
2505                 }
2506                 /* Hm, it seems this will take some time. Use msleep(). */
2507                 for (i = 40; i; i--) {
2508                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2509                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2510                                 goto out;
2511                         msleep(1);
2512                 }
2513                 b43err(dev->wl, "MAC suspend failed\n");
2514         }
2515 out:
2516         dev->mac_suspended++;
2517 }
2518
2519 static void b43_adjust_opmode(struct b43_wldev *dev)
2520 {
2521         struct b43_wl *wl = dev->wl;
2522         u32 ctl;
2523         u16 cfp_pretbtt;
2524
2525         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2526         /* Reset status to STA infrastructure mode. */
2527         ctl &= ~B43_MACCTL_AP;
2528         ctl &= ~B43_MACCTL_KEEP_CTL;
2529         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2530         ctl &= ~B43_MACCTL_KEEP_BAD;
2531         ctl &= ~B43_MACCTL_PROMISC;
2532         ctl &= ~B43_MACCTL_BEACPROMISC;
2533         ctl |= B43_MACCTL_INFRA;
2534
2535         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2536             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2537                 ctl |= B43_MACCTL_AP;
2538         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2539                 ctl &= ~B43_MACCTL_INFRA;
2540
2541         if (wl->filter_flags & FIF_CONTROL)
2542                 ctl |= B43_MACCTL_KEEP_CTL;
2543         if (wl->filter_flags & FIF_FCSFAIL)
2544                 ctl |= B43_MACCTL_KEEP_BAD;
2545         if (wl->filter_flags & FIF_PLCPFAIL)
2546                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2547         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2548                 ctl |= B43_MACCTL_PROMISC;
2549         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2550                 ctl |= B43_MACCTL_BEACPROMISC;
2551
2552         /* Workaround: On old hardware the HW-MAC-address-filter
2553          * doesn't work properly, so always run promisc in filter
2554          * it in software. */
2555         if (dev->dev->id.revision <= 4)
2556                 ctl |= B43_MACCTL_PROMISC;
2557
2558         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2559
2560         cfp_pretbtt = 2;
2561         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2562                 if (dev->dev->bus->chip_id == 0x4306 &&
2563                     dev->dev->bus->chip_rev == 3)
2564                         cfp_pretbtt = 100;
2565                 else
2566                         cfp_pretbtt = 50;
2567         }
2568         b43_write16(dev, 0x612, cfp_pretbtt);
2569 }
2570
2571 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2572 {
2573         u16 offset;
2574
2575         if (is_ofdm) {
2576                 offset = 0x480;
2577                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2578         } else {
2579                 offset = 0x4C0;
2580                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2581         }
2582         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2583                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2584 }
2585
2586 static void b43_rate_memory_init(struct b43_wldev *dev)
2587 {
2588         switch (dev->phy.type) {
2589         case B43_PHYTYPE_A:
2590         case B43_PHYTYPE_G:
2591         case B43_PHYTYPE_N:
2592                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2593                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2594                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2595                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2596                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2597                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2598                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2599                 if (dev->phy.type == B43_PHYTYPE_A)
2600                         break;
2601                 /* fallthrough */
2602         case B43_PHYTYPE_B:
2603                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2604                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2605                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2606                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2607                 break;
2608         default:
2609                 B43_WARN_ON(1);
2610         }
2611 }
2612
2613 /* Set the default values for the PHY TX Control Words. */
2614 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2615 {
2616         u16 ctl = 0;
2617
2618         ctl |= B43_TXH_PHY_ENC_CCK;
2619         ctl |= B43_TXH_PHY_ANT01AUTO;
2620         ctl |= B43_TXH_PHY_TXPWR;
2621
2622         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2623         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2624         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2625 }
2626
2627 /* Set the TX-Antenna for management frames sent by firmware. */
2628 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2629 {
2630         u16 ant;
2631         u16 tmp;
2632
2633         ant = b43_antenna_to_phyctl(antenna);
2634
2635         /* For ACK/CTS */
2636         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2637         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2638         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2639         /* For Probe Resposes */
2640         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2641         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2642         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2643 }
2644
2645 /* This is the opposite of b43_chip_init() */
2646 static void b43_chip_exit(struct b43_wldev *dev)
2647 {
2648         b43_phy_exit(dev);
2649         b43_gpio_cleanup(dev);
2650         /* firmware is released later */
2651 }
2652
2653 /* Initialize the chip
2654  * http://bcm-specs.sipsolutions.net/ChipInit
2655  */
2656 static int b43_chip_init(struct b43_wldev *dev)
2657 {
2658         struct b43_phy *phy = &dev->phy;
2659         int err;
2660         u32 value32, macctl;
2661         u16 value16;
2662
2663         /* Initialize the MAC control */
2664         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2665         if (dev->phy.gmode)
2666                 macctl |= B43_MACCTL_GMODE;
2667         macctl |= B43_MACCTL_INFRA;
2668         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2669
2670         err = b43_request_firmware(dev);
2671         if (err)
2672                 goto out;
2673         err = b43_upload_microcode(dev);
2674         if (err)
2675                 goto out;       /* firmware is released later */
2676
2677         err = b43_gpio_init(dev);
2678         if (err)
2679                 goto out;       /* firmware is released later */
2680
2681         err = b43_upload_initvals(dev);
2682         if (err)
2683                 goto err_gpio_clean;
2684
2685         /* Turn the Analog on and initialize the PHY. */
2686         phy->ops->switch_analog(dev, 1);
2687         err = b43_phy_init(dev);
2688         if (err)
2689                 goto err_gpio_clean;
2690
2691         /* Disable Interference Mitigation. */
2692         if (phy->ops->interf_mitigation)
2693                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2694
2695         /* Select the antennae */
2696         if (phy->ops->set_rx_antenna)
2697                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2698         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2699
2700         if (phy->type == B43_PHYTYPE_B) {
2701                 value16 = b43_read16(dev, 0x005E);
2702                 value16 |= 0x0004;
2703                 b43_write16(dev, 0x005E, value16);
2704         }
2705         b43_write32(dev, 0x0100, 0x01000000);
2706         if (dev->dev->id.revision < 5)
2707                 b43_write32(dev, 0x010C, 0x01000000);
2708
2709         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2710                     & ~B43_MACCTL_INFRA);
2711         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2712                     | B43_MACCTL_INFRA);
2713
2714         /* Probe Response Timeout value */
2715         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2716         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2717
2718         /* Initially set the wireless operation mode. */
2719         b43_adjust_opmode(dev);
2720
2721         if (dev->dev->id.revision < 3) {
2722                 b43_write16(dev, 0x060E, 0x0000);
2723                 b43_write16(dev, 0x0610, 0x8000);
2724                 b43_write16(dev, 0x0604, 0x0000);
2725                 b43_write16(dev, 0x0606, 0x0200);
2726         } else {
2727                 b43_write32(dev, 0x0188, 0x80000000);
2728                 b43_write32(dev, 0x018C, 0x02000000);
2729         }
2730         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2731         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2732         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2733         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2734         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2735         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2736         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2737
2738         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2739         value32 |= 0x00100000;
2740         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2741
2742         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2743                     dev->dev->bus->chipco.fast_pwrup_delay);
2744
2745         err = 0;
2746         b43dbg(dev->wl, "Chip initialized\n");
2747 out:
2748         return err;
2749
2750 err_gpio_clean:
2751         b43_gpio_cleanup(dev);
2752         return err;
2753 }
2754
2755 static void b43_periodic_every60sec(struct b43_wldev *dev)
2756 {
2757         const struct b43_phy_operations *ops = dev->phy.ops;
2758
2759         if (ops->pwork_60sec)
2760                 ops->pwork_60sec(dev);
2761
2762         /* Force check the TX power emission now. */
2763         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2764 }
2765
2766 static void b43_periodic_every30sec(struct b43_wldev *dev)
2767 {
2768         /* Update device statistics. */
2769         b43_calculate_link_quality(dev);
2770 }
2771
2772 static void b43_periodic_every15sec(struct b43_wldev *dev)
2773 {
2774         struct b43_phy *phy = &dev->phy;
2775         u16 wdr;
2776
2777         if (dev->fw.opensource) {
2778                 /* Check if the firmware is still alive.
2779                  * It will reset the watchdog counter to 0 in its idle loop. */
2780                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2781                 if (unlikely(wdr)) {
2782                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2783                         b43_controller_restart(dev, "Firmware watchdog");
2784                         return;
2785                 } else {
2786                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2787                                         B43_WATCHDOG_REG, 1);
2788                 }
2789         }
2790
2791         if (phy->ops->pwork_15sec)
2792                 phy->ops->pwork_15sec(dev);
2793
2794         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2795         wmb();
2796 }
2797
2798 static void do_periodic_work(struct b43_wldev *dev)
2799 {
2800         unsigned int state;
2801
2802         state = dev->periodic_state;
2803         if (state % 4 == 0)
2804                 b43_periodic_every60sec(dev);
2805         if (state % 2 == 0)
2806                 b43_periodic_every30sec(dev);
2807         b43_periodic_every15sec(dev);
2808 }
2809
2810 /* Periodic work locking policy:
2811  *      The whole periodic work handler is protected by
2812  *      wl->mutex. If another lock is needed somewhere in the
2813  *      pwork callchain, it's aquired in-place, where it's needed.
2814  */
2815 static void b43_periodic_work_handler(struct work_struct *work)
2816 {
2817         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2818                                              periodic_work.work);
2819         struct b43_wl *wl = dev->wl;
2820         unsigned long delay;
2821
2822         mutex_lock(&wl->mutex);
2823
2824         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2825                 goto out;
2826         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2827                 goto out_requeue;
2828
2829         do_periodic_work(dev);
2830
2831         dev->periodic_state++;
2832 out_requeue:
2833         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2834                 delay = msecs_to_jiffies(50);
2835         else
2836                 delay = round_jiffies_relative(HZ * 15);
2837         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2838 out:
2839         mutex_unlock(&wl->mutex);
2840 }
2841
2842 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2843 {
2844         struct delayed_work *work = &dev->periodic_work;
2845
2846         dev->periodic_state = 0;
2847         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2848         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2849 }
2850
2851 /* Check if communication with the device works correctly. */
2852 static int b43_validate_chipaccess(struct b43_wldev *dev)
2853 {
2854         u32 v, backup0, backup4;
2855
2856         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2857         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2858
2859         /* Check for read/write and endianness problems. */
2860         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2861         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2862                 goto error;
2863         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2864         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2865                 goto error;
2866
2867         /* Check if unaligned 32bit SHM_SHARED access works properly.
2868          * However, don't bail out on failure, because it's noncritical. */
2869         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2870         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2871         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2872         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2873         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2874                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2875         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2876         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2877             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2878             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2879             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2880                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2881
2882         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2883         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2884
2885         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2886                 /* The 32bit register shadows the two 16bit registers
2887                  * with update sideeffects. Validate this. */
2888                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2889                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2890                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2891                         goto error;
2892                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2893                         goto error;
2894         }
2895         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2896
2897         v = b43_read32(dev, B43_MMIO_MACCTL);
2898         v |= B43_MACCTL_GMODE;
2899         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2900                 goto error;
2901
2902         return 0;
2903 error:
2904         b43err(dev->wl, "Failed to validate the chipaccess\n");
2905         return -ENODEV;
2906 }
2907
2908 static void b43_security_init(struct b43_wldev *dev)
2909 {
2910         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2911         /* KTP is a word address, but we address SHM bytewise.
2912          * So multiply by two.
2913          */
2914         dev->ktp *= 2;
2915         /* Number of RCMTA address slots */
2916         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
2917         /* Clear the key memory. */
2918         b43_clear_keys(dev);
2919 }
2920
2921 #ifdef CONFIG_B43_HWRNG
2922 static int b43_rng_read(struct hwrng *rng, u32 *data)
2923 {
2924         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2925         unsigned long flags;
2926
2927         /* Don't take wl->mutex here, as it could deadlock with
2928          * hwrng internal locking. It's not needed to take
2929          * wl->mutex here, anyway. */
2930
2931         spin_lock_irqsave(&wl->irq_lock, flags);
2932         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2933         spin_unlock_irqrestore(&wl->irq_lock, flags);
2934
2935         return (sizeof(u16));
2936 }
2937 #endif /* CONFIG_B43_HWRNG */
2938
2939 static void b43_rng_exit(struct b43_wl *wl)
2940 {
2941 #ifdef CONFIG_B43_HWRNG
2942         if (wl->rng_initialized)
2943                 hwrng_unregister(&wl->rng);
2944 #endif /* CONFIG_B43_HWRNG */
2945 }
2946
2947 static int b43_rng_init(struct b43_wl *wl)
2948 {
2949         int err = 0;
2950
2951 #ifdef CONFIG_B43_HWRNG
2952         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2953                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2954         wl->rng.name = wl->rng_name;
2955         wl->rng.data_read = b43_rng_read;
2956         wl->rng.priv = (unsigned long)wl;
2957         wl->rng_initialized = 1;
2958         err = hwrng_register(&wl->rng);
2959         if (err) {
2960                 wl->rng_initialized = 0;
2961                 b43err(wl, "Failed to register the random "
2962                        "number generator (%d)\n", err);
2963         }
2964 #endif /* CONFIG_B43_HWRNG */
2965
2966         return err;
2967 }
2968
2969 static int b43_op_tx(struct ieee80211_hw *hw,
2970                      struct sk_buff *skb)
2971 {
2972         struct b43_wl *wl = hw_to_b43_wl(hw);
2973         struct b43_wldev *dev = wl->current_dev;
2974         unsigned long flags;
2975         int err;
2976
2977         if (unlikely(skb->len < 2 + 2 + 6)) {
2978                 /* Too short, this can't be a valid frame. */
2979                 goto drop_packet;
2980         }
2981         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2982         if (unlikely(!dev))
2983                 goto drop_packet;
2984
2985         /* Transmissions on seperate queues can run concurrently. */
2986         read_lock_irqsave(&wl->tx_lock, flags);
2987
2988         err = -ENODEV;
2989         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2990                 if (b43_using_pio_transfers(dev))
2991                         err = b43_pio_tx(dev, skb);
2992                 else
2993                         err = b43_dma_tx(dev, skb);
2994         }
2995
2996         read_unlock_irqrestore(&wl->tx_lock, flags);
2997
2998         if (unlikely(err))
2999                 goto drop_packet;
3000         return NETDEV_TX_OK;
3001
3002 drop_packet:
3003         /* We can not transmit this packet. Drop it. */
3004         dev_kfree_skb_any(skb);
3005         return NETDEV_TX_OK;
3006 }
3007
3008 /* Locking: wl->irq_lock */
3009 static void b43_qos_params_upload(struct b43_wldev *dev,
3010                                   const struct ieee80211_tx_queue_params *p,
3011                                   u16 shm_offset)
3012 {
3013         u16 params[B43_NR_QOSPARAMS];
3014         int bslots, tmp;
3015         unsigned int i;
3016
3017         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3018
3019         memset(&params, 0, sizeof(params));
3020
3021         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3022         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3023         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3024         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3025         params[B43_QOSPARAM_AIFS] = p->aifs;
3026         params[B43_QOSPARAM_BSLOTS] = bslots;
3027         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3028
3029         for (i = 0; i < ARRAY_SIZE(params); i++) {
3030                 if (i == B43_QOSPARAM_STATUS) {
3031                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3032                                              shm_offset + (i * 2));
3033                         /* Mark the parameters as updated. */
3034                         tmp |= 0x100;
3035                         b43_shm_write16(dev, B43_SHM_SHARED,
3036                                         shm_offset + (i * 2),
3037                                         tmp);
3038                 } else {
3039                         b43_shm_write16(dev, B43_SHM_SHARED,
3040                                         shm_offset + (i * 2),
3041                                         params[i]);
3042                 }
3043         }
3044 }
3045
3046 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3047 static const u16 b43_qos_shm_offsets[] = {
3048         /* [mac80211-queue-nr] = SHM_OFFSET, */
3049         [0] = B43_QOS_VOICE,
3050         [1] = B43_QOS_VIDEO,
3051         [2] = B43_QOS_BESTEFFORT,
3052         [3] = B43_QOS_BACKGROUND,
3053 };
3054
3055 /* Update all QOS parameters in hardware. */
3056 static void b43_qos_upload_all(struct b43_wldev *dev)
3057 {
3058         struct b43_wl *wl = dev->wl;
3059         struct b43_qos_params *params;
3060         unsigned int i;
3061
3062         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3063                      ARRAY_SIZE(wl->qos_params));
3064
3065         b43_mac_suspend(dev);
3066         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3067                 params = &(wl->qos_params[i]);
3068                 b43_qos_params_upload(dev, &(params->p),
3069                                       b43_qos_shm_offsets[i]);
3070         }
3071         b43_mac_enable(dev);
3072 }
3073
3074 static void b43_qos_clear(struct b43_wl *wl)
3075 {
3076         struct b43_qos_params *params;
3077         unsigned int i;
3078
3079         /* Initialize QoS parameters to sane defaults. */
3080
3081         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3082                      ARRAY_SIZE(wl->qos_params));
3083
3084         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3085                 params = &(wl->qos_params[i]);
3086
3087                 switch (b43_qos_shm_offsets[i]) {
3088                 case B43_QOS_VOICE:
3089                         params->p.txop = 0;
3090                         params->p.aifs = 2;
3091                         params->p.cw_min = 0x0001;
3092                         params->p.cw_max = 0x0001;
3093                         break;
3094                 case B43_QOS_VIDEO:
3095                         params->p.txop = 0;
3096                         params->p.aifs = 2;
3097                         params->p.cw_min = 0x0001;
3098                         params->p.cw_max = 0x0001;
3099                         break;
3100                 case B43_QOS_BESTEFFORT:
3101                         params->p.txop = 0;
3102                         params->p.aifs = 3;
3103                         params->p.cw_min = 0x0001;
3104                         params->p.cw_max = 0x03FF;
3105                         break;
3106                 case B43_QOS_BACKGROUND:
3107                         params->p.txop = 0;
3108                         params->p.aifs = 7;
3109                         params->p.cw_min = 0x0001;
3110                         params->p.cw_max = 0x03FF;
3111                         break;
3112                 default:
3113                         B43_WARN_ON(1);
3114                 }
3115         }
3116 }
3117
3118 /* Initialize the core's QOS capabilities */
3119 static void b43_qos_init(struct b43_wldev *dev)
3120 {
3121         /* Upload the current QOS parameters. */
3122         b43_qos_upload_all(dev);
3123
3124         /* Enable QOS support. */
3125         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3126         b43_write16(dev, B43_MMIO_IFSCTL,
3127                     b43_read16(dev, B43_MMIO_IFSCTL)
3128                     | B43_MMIO_IFSCTL_USE_EDCF);
3129 }
3130
3131 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3132                           const struct ieee80211_tx_queue_params *params)
3133 {
3134         struct b43_wl *wl = hw_to_b43_wl(hw);
3135         struct b43_wldev *dev;
3136         unsigned int queue = (unsigned int)_queue;
3137         int err = -ENODEV;
3138
3139         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3140                 /* Queue not available or don't support setting
3141                  * params on this queue. Return success to not
3142                  * confuse mac80211. */
3143                 return 0;
3144         }
3145         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3146                      ARRAY_SIZE(wl->qos_params));
3147
3148         mutex_lock(&wl->mutex);
3149         dev = wl->current_dev;
3150         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3151                 goto out_unlock;
3152
3153         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3154         b43_mac_suspend(dev);
3155         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3156                               b43_qos_shm_offsets[queue]);
3157         b43_mac_enable(dev);
3158         err = 0;
3159
3160 out_unlock:
3161         mutex_unlock(&wl->mutex);
3162
3163         return err;
3164 }
3165
3166 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3167                                struct ieee80211_tx_queue_stats *stats)
3168 {
3169         struct b43_wl *wl = hw_to_b43_wl(hw);
3170         struct b43_wldev *dev = wl->current_dev;
3171         unsigned long flags;
3172         int err = -ENODEV;
3173
3174         if (!dev)
3175                 goto out;
3176         spin_lock_irqsave(&wl->irq_lock, flags);
3177         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3178                 if (b43_using_pio_transfers(dev))
3179                         b43_pio_get_tx_stats(dev, stats);
3180                 else
3181                         b43_dma_get_tx_stats(dev, stats);
3182                 err = 0;
3183         }
3184         spin_unlock_irqrestore(&wl->irq_lock, flags);
3185 out:
3186         return err;
3187 }
3188
3189 static int b43_op_get_stats(struct ieee80211_hw *hw,
3190                             struct ieee80211_low_level_stats *stats)
3191 {
3192         struct b43_wl *wl = hw_to_b43_wl(hw);
3193         unsigned long flags;
3194
3195         spin_lock_irqsave(&wl->irq_lock, flags);
3196         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3197         spin_unlock_irqrestore(&wl->irq_lock, flags);
3198
3199         return 0;
3200 }
3201
3202 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3203 {
3204         struct b43_wl *wl = hw_to_b43_wl(hw);
3205         struct b43_wldev *dev;
3206         u64 tsf;
3207
3208         mutex_lock(&wl->mutex);
3209         spin_lock_irq(&wl->irq_lock);
3210         dev = wl->current_dev;
3211
3212         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3213                 b43_tsf_read(dev, &tsf);
3214         else
3215                 tsf = 0;
3216
3217         spin_unlock_irq(&wl->irq_lock);
3218         mutex_unlock(&wl->mutex);
3219
3220         return tsf;
3221 }
3222
3223 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3224 {
3225         struct b43_wl *wl = hw_to_b43_wl(hw);
3226         struct b43_wldev *dev;
3227
3228         mutex_lock(&wl->mutex);
3229         spin_lock_irq(&wl->irq_lock);
3230         dev = wl->current_dev;
3231
3232         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3233                 b43_tsf_write(dev, tsf);
3234
3235         spin_unlock_irq(&wl->irq_lock);
3236         mutex_unlock(&wl->mutex);
3237 }
3238
3239 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3240 {
3241         struct ssb_device *sdev = dev->dev;
3242         u32 tmslow;
3243
3244         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3245         tmslow &= ~B43_TMSLOW_GMODE;
3246         tmslow |= B43_TMSLOW_PHYRESET;
3247         tmslow |= SSB_TMSLOW_FGC;
3248         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3249         msleep(1);
3250
3251         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3252         tmslow &= ~SSB_TMSLOW_FGC;
3253         tmslow |= B43_TMSLOW_PHYRESET;
3254         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3255         msleep(1);
3256 }
3257
3258 static const char *band_to_string(enum ieee80211_band band)
3259 {
3260         switch (band) {
3261         case IEEE80211_BAND_5GHZ:
3262                 return "5";
3263         case IEEE80211_BAND_2GHZ:
3264                 return "2.4";
3265         default:
3266                 break;
3267         }
3268         B43_WARN_ON(1);
3269         return "";
3270 }
3271
3272 /* Expects wl->mutex locked */
3273 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3274 {
3275         struct b43_wldev *up_dev = NULL;
3276         struct b43_wldev *down_dev;
3277         struct b43_wldev *d;
3278         int err;
3279         bool uninitialized_var(gmode);
3280         int prev_status;
3281
3282         /* Find a device and PHY which supports the band. */
3283         list_for_each_entry(d, &wl->devlist, list) {
3284                 switch (chan->band) {
3285                 case IEEE80211_BAND_5GHZ:
3286                         if (d->phy.supports_5ghz) {
3287                                 up_dev = d;
3288                                 gmode = 0;
3289                         }
3290                         break;
3291                 case IEEE80211_BAND_2GHZ:
3292                         if (d->phy.supports_2ghz) {
3293                                 up_dev = d;
3294                                 gmode = 1;
3295                         }
3296                         break;
3297                 default:
3298                         B43_WARN_ON(1);
3299                         return -EINVAL;
3300                 }
3301                 if (up_dev)
3302                         break;
3303         }
3304         if (!up_dev) {
3305                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3306                        band_to_string(chan->band));
3307                 return -ENODEV;
3308         }
3309         if ((up_dev == wl->current_dev) &&
3310             (!!wl->current_dev->phy.gmode == !!gmode)) {
3311                 /* This device is already running. */
3312                 return 0;
3313         }
3314         b43dbg(wl, "Switching to %s-GHz band\n",
3315                band_to_string(chan->band));
3316         down_dev = wl->current_dev;
3317
3318         prev_status = b43_status(down_dev);
3319         /* Shutdown the currently running core. */
3320         if (prev_status >= B43_STAT_STARTED)
3321                 b43_wireless_core_stop(down_dev);
3322         if (prev_status >= B43_STAT_INITIALIZED)
3323                 b43_wireless_core_exit(down_dev);
3324
3325         if (down_dev != up_dev) {
3326                 /* We switch to a different core, so we put PHY into
3327                  * RESET on the old core. */
3328                 b43_put_phy_into_reset(down_dev);
3329         }
3330
3331         /* Now start the new core. */
3332         up_dev->phy.gmode = gmode;
3333         if (prev_status >= B43_STAT_INITIALIZED) {
3334                 err = b43_wireless_core_init(up_dev);
3335                 if (err) {
3336                         b43err(wl, "Fatal: Could not initialize device for "
3337                                "selected %s-GHz band\n",
3338                                band_to_string(chan->band));
3339                         goto init_failure;
3340                 }
3341         }
3342         if (prev_status >= B43_STAT_STARTED) {
3343                 err = b43_wireless_core_start(up_dev);
3344                 if (err) {
3345                         b43err(wl, "Fatal: Coult not start device for "
3346                                "selected %s-GHz band\n",
3347                                band_to_string(chan->band));
3348                         b43_wireless_core_exit(up_dev);
3349                         goto init_failure;
3350                 }
3351         }
3352         B43_WARN_ON(b43_status(up_dev) != prev_status);
3353
3354         wl->current_dev = up_dev;
3355
3356         return 0;
3357 init_failure:
3358         /* Whoops, failed to init the new core. No core is operating now. */
3359         wl->current_dev = NULL;
3360         return err;
3361 }
3362
3363 /* Write the short and long frame retry limit values. */
3364 static void b43_set_retry_limits(struct b43_wldev *dev,
3365                                  unsigned int short_retry,
3366                                  unsigned int long_retry)
3367 {
3368         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3369          * the chip-internal counter. */
3370         short_retry = min(short_retry, (unsigned int)0xF);
3371         long_retry = min(long_retry, (unsigned int)0xF);
3372
3373         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3374                         short_retry);
3375         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3376                         long_retry);
3377 }
3378
3379 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3380 {
3381         struct b43_wl *wl = hw_to_b43_wl(hw);
3382         struct b43_wldev *dev;
3383         struct b43_phy *phy;
3384         struct ieee80211_conf *conf = &hw->conf;
3385         unsigned long flags;
3386         int antenna;
3387         int err = 0;
3388
3389         mutex_lock(&wl->mutex);
3390
3391         /* Switch the band (if necessary). This might change the active core. */
3392         err = b43_switch_band(wl, conf->channel);
3393         if (err)
3394                 goto out_unlock_mutex;
3395         dev = wl->current_dev;
3396         phy = &dev->phy;
3397
3398         b43_mac_suspend(dev);
3399
3400         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3401                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3402                                           conf->long_frame_max_tx_count);
3403         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3404         if (!changed)
3405                 goto out_mac_enable;
3406
3407         /* Switch to the requested channel.
3408          * The firmware takes care of races with the TX handler. */
3409         if (conf->channel->hw_value != phy->channel)
3410                 b43_switch_channel(dev, conf->channel->hw_value);
3411
3412         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3413
3414         /* Adjust the desired TX power level. */
3415         if (conf->power_level != 0) {
3416                 spin_lock_irqsave(&wl->irq_lock, flags);
3417                 if (conf->power_level != phy->desired_txpower) {
3418                         phy->desired_txpower = conf->power_level;
3419                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3420                                                    B43_TXPWR_IGNORE_TSSI);
3421                 }
3422                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3423         }
3424
3425         /* Antennas for RX and management frame TX. */
3426         antenna = B43_ANTENNA_DEFAULT;
3427         b43_mgmtframe_txantenna(dev, antenna);
3428         antenna = B43_ANTENNA_DEFAULT;
3429         if (phy->ops->set_rx_antenna)
3430                 phy->ops->set_rx_antenna(dev, antenna);
3431
3432         if (wl->radio_enabled != phy->radio_on) {
3433                 if (wl->radio_enabled) {
3434                         b43_software_rfkill(dev, false);
3435                         b43info(dev->wl, "Radio turned on by software\n");
3436                         if (!dev->radio_hw_enable) {
3437                                 b43info(dev->wl, "The hardware RF-kill button "
3438                                         "still turns the radio physically off. "
3439                                         "Press the button to turn it on.\n");
3440                         }
3441                 } else {
3442                         b43_software_rfkill(dev, true);
3443                         b43info(dev->wl, "Radio turned off by software\n");
3444                 }
3445         }
3446
3447 out_mac_enable:
3448         b43_mac_enable(dev);
3449 out_unlock_mutex:
3450         mutex_unlock(&wl->mutex);
3451
3452         return err;
3453 }
3454
3455 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3456 {
3457         struct ieee80211_supported_band *sband =
3458                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3459         struct ieee80211_rate *rate;
3460         int i;
3461         u16 basic, direct, offset, basic_offset, rateptr;
3462
3463         for (i = 0; i < sband->n_bitrates; i++) {
3464                 rate = &sband->bitrates[i];
3465
3466                 if (b43_is_cck_rate(rate->hw_value)) {
3467                         direct = B43_SHM_SH_CCKDIRECT;
3468                         basic = B43_SHM_SH_CCKBASIC;
3469                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3470                         offset &= 0xF;
3471                 } else {
3472                         direct = B43_SHM_SH_OFDMDIRECT;
3473                         basic = B43_SHM_SH_OFDMBASIC;
3474                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3475                         offset &= 0xF;
3476                 }
3477
3478                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3479
3480                 if (b43_is_cck_rate(rate->hw_value)) {
3481                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3482                         basic_offset &= 0xF;
3483                 } else {
3484                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3485                         basic_offset &= 0xF;
3486                 }
3487
3488                 /*
3489                  * Get the pointer that we need to point to
3490                  * from the direct map
3491                  */
3492                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3493                                          direct + 2 * basic_offset);
3494                 /* and write it to the basic map */
3495                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3496                                 rateptr);
3497         }
3498 }
3499
3500 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3501                                     struct ieee80211_vif *vif,
3502                                     struct ieee80211_bss_conf *conf,
3503                                     u32 changed)
3504 {
3505         struct b43_wl *wl = hw_to_b43_wl(hw);
3506         struct b43_wldev *dev;
3507         unsigned long flags;
3508
3509         mutex_lock(&wl->mutex);
3510
3511         dev = wl->current_dev;
3512         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3513                 goto out_unlock_mutex;
3514
3515         B43_WARN_ON(wl->vif != vif);
3516
3517         spin_lock_irqsave(&wl->irq_lock, flags);
3518         if (changed & BSS_CHANGED_BSSID) {
3519                 if (conf->bssid)
3520                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3521                 else
3522                         memset(wl->bssid, 0, ETH_ALEN);
3523         }
3524
3525         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3526                 if (changed & BSS_CHANGED_BEACON &&
3527                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3528                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3529                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3530                         b43_update_templates(wl);
3531
3532                 if (changed & BSS_CHANGED_BSSID)
3533                         b43_write_mac_bssid_templates(dev);
3534         }
3535         spin_unlock_irqrestore(&wl->irq_lock, flags);
3536
3537         b43_mac_suspend(dev);
3538
3539         /* Update templates for AP/mesh mode. */
3540         if (changed & BSS_CHANGED_BEACON_INT &&
3541             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3542              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3543              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3544                 b43_set_beacon_int(dev, conf->beacon_int);
3545
3546         if (changed & BSS_CHANGED_BASIC_RATES)
3547                 b43_update_basic_rates(dev, conf->basic_rates);
3548
3549         if (changed & BSS_CHANGED_ERP_SLOT) {
3550                 if (conf->use_short_slot)
3551                         b43_short_slot_timing_enable(dev);
3552                 else
3553                         b43_short_slot_timing_disable(dev);
3554         }
3555
3556         b43_mac_enable(dev);
3557 out_unlock_mutex:
3558         mutex_unlock(&wl->mutex);
3559 }
3560
3561 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3562                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3563                           struct ieee80211_key_conf *key)
3564 {
3565         struct b43_wl *wl = hw_to_b43_wl(hw);
3566         struct b43_wldev *dev;
3567         u8 algorithm;
3568         u8 index;
3569         int err;
3570         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3571
3572         if (modparam_nohwcrypt)
3573                 return -ENOSPC; /* User disabled HW-crypto */
3574
3575         mutex_lock(&wl->mutex);
3576         spin_lock_irq(&wl->irq_lock);
3577         write_lock(&wl->tx_lock);
3578         /* Why do we need all this locking here?
3579          * mutex     -> Every config operation must take it.
3580          * irq_lock  -> We modify the dev->key array, which is accessed
3581          *              in the IRQ handlers.
3582          * tx_lock   -> We modify the dev->key array, which is accessed
3583          *              in the TX handler.
3584          */
3585
3586         dev = wl->current_dev;
3587         err = -ENODEV;
3588         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3589                 goto out_unlock;
3590
3591         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3592                 /* We don't have firmware for the crypto engine.
3593                  * Must use software-crypto. */
3594                 err = -EOPNOTSUPP;
3595                 goto out_unlock;
3596         }
3597
3598         err = -EINVAL;
3599         switch (key->alg) {
3600         case ALG_WEP:
3601                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3602                         algorithm = B43_SEC_ALGO_WEP40;
3603                 else
3604                         algorithm = B43_SEC_ALGO_WEP104;
3605                 break;
3606         case ALG_TKIP:
3607                 algorithm = B43_SEC_ALGO_TKIP;
3608                 break;
3609         case ALG_CCMP:
3610                 algorithm = B43_SEC_ALGO_AES;
3611                 break;
3612         default:
3613                 B43_WARN_ON(1);
3614                 goto out_unlock;
3615         }
3616         index = (u8) (key->keyidx);
3617         if (index > 3)
3618                 goto out_unlock;
3619
3620         switch (cmd) {
3621         case SET_KEY:
3622                 if (algorithm == B43_SEC_ALGO_TKIP) {
3623                         /* FIXME: No TKIP hardware encryption for now. */
3624                         err = -EOPNOTSUPP;
3625                         goto out_unlock;
3626                 }
3627
3628                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3629                         if (WARN_ON(!sta)) {
3630                                 err = -EOPNOTSUPP;
3631                                 goto out_unlock;
3632                         }
3633                         /* Pairwise key with an assigned MAC address. */
3634                         err = b43_key_write(dev, -1, algorithm,
3635                                             key->key, key->keylen,
3636                                             sta->addr, key);
3637                 } else {
3638                         /* Group key */
3639                         err = b43_key_write(dev, index, algorithm,
3640                                             key->key, key->keylen, NULL, key);
3641                 }
3642                 if (err)
3643                         goto out_unlock;
3644
3645                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3646                     algorithm == B43_SEC_ALGO_WEP104) {
3647                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3648                 } else {
3649                         b43_hf_write(dev,
3650                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3651                 }
3652                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3653                 break;
3654         case DISABLE_KEY: {
3655                 err = b43_key_clear(dev, key->hw_key_idx);
3656                 if (err)
3657                         goto out_unlock;
3658                 break;
3659         }
3660         default:
3661                 B43_WARN_ON(1);
3662         }
3663
3664 out_unlock:
3665         if (!err) {
3666                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3667                        "mac: %pM\n",
3668                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3669                        sta ? sta->addr : bcast_addr);
3670                 b43_dump_keymemory(dev);
3671         }
3672         write_unlock(&wl->tx_lock);
3673         spin_unlock_irq(&wl->irq_lock);
3674         mutex_unlock(&wl->mutex);
3675
3676         return err;
3677 }
3678
3679 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3680                                     unsigned int changed, unsigned int *fflags,
3681                                     int mc_count, struct dev_addr_list *mc_list)
3682 {
3683         struct b43_wl *wl = hw_to_b43_wl(hw);
3684         struct b43_wldev *dev = wl->current_dev;
3685         unsigned long flags;
3686
3687         if (!dev) {
3688                 *fflags = 0;
3689                 return;
3690         }
3691
3692         spin_lock_irqsave(&wl->irq_lock, flags);
3693         *fflags &= FIF_PROMISC_IN_BSS |
3694                   FIF_ALLMULTI |
3695                   FIF_FCSFAIL |
3696                   FIF_PLCPFAIL |
3697                   FIF_CONTROL |
3698                   FIF_OTHER_BSS |
3699                   FIF_BCN_PRBRESP_PROMISC;
3700
3701         changed &= FIF_PROMISC_IN_BSS |
3702                    FIF_ALLMULTI |
3703                    FIF_FCSFAIL |
3704                    FIF_PLCPFAIL |
3705                    FIF_CONTROL |
3706                    FIF_OTHER_BSS |
3707                    FIF_BCN_PRBRESP_PROMISC;
3708
3709         wl->filter_flags = *fflags;
3710
3711         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3712                 b43_adjust_opmode(dev);
3713         spin_unlock_irqrestore(&wl->irq_lock, flags);
3714 }
3715
3716 /* Locking: wl->mutex */
3717 static void b43_wireless_core_stop(struct b43_wldev *dev)
3718 {
3719         struct b43_wl *wl = dev->wl;
3720         unsigned long flags;
3721
3722         if (b43_status(dev) < B43_STAT_STARTED)
3723                 return;
3724
3725         /* Disable and sync interrupts. We must do this before than
3726          * setting the status to INITIALIZED, as the interrupt handler
3727          * won't care about IRQs then. */
3728         spin_lock_irqsave(&wl->irq_lock, flags);
3729         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3730         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3731         spin_unlock_irqrestore(&wl->irq_lock, flags);
3732         b43_synchronize_irq(dev);
3733
3734         write_lock_irqsave(&wl->tx_lock, flags);
3735         b43_set_status(dev, B43_STAT_INITIALIZED);
3736         write_unlock_irqrestore(&wl->tx_lock, flags);
3737
3738         b43_pio_stop(dev);
3739         mutex_unlock(&wl->mutex);
3740         /* Must unlock as it would otherwise deadlock. No races here.
3741          * Cancel the possibly running self-rearming periodic work. */
3742         cancel_delayed_work_sync(&dev->periodic_work);
3743         mutex_lock(&wl->mutex);
3744
3745         b43_mac_suspend(dev);
3746         free_irq(dev->dev->irq, dev);
3747         b43dbg(wl, "Wireless interface stopped\n");
3748 }
3749
3750 /* Locking: wl->mutex */
3751 static int b43_wireless_core_start(struct b43_wldev *dev)
3752 {
3753         int err;
3754
3755         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3756
3757         drain_txstatus_queue(dev);
3758         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3759                           IRQF_SHARED, KBUILD_MODNAME, dev);
3760         if (err) {
3761                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3762                 goto out;
3763         }
3764
3765         /* We are ready to run. */
3766         b43_set_status(dev, B43_STAT_STARTED);
3767
3768         /* Start data flow (TX/RX). */
3769         b43_mac_enable(dev);
3770         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3771
3772         /* Start maintainance work */
3773         b43_periodic_tasks_setup(dev);
3774
3775         b43dbg(dev->wl, "Wireless interface started\n");
3776       out:
3777         return err;
3778 }
3779
3780 /* Get PHY and RADIO versioning numbers */
3781 static int b43_phy_versioning(struct b43_wldev *dev)
3782 {
3783         struct b43_phy *phy = &dev->phy;
3784         u32 tmp;
3785         u8 analog_type;
3786         u8 phy_type;
3787         u8 phy_rev;
3788         u16 radio_manuf;
3789         u16 radio_ver;
3790         u16 radio_rev;
3791         int unsupported = 0;
3792
3793         /* Get PHY versioning */
3794         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3795         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3796         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3797         phy_rev = (tmp & B43_PHYVER_VERSION);
3798         switch (phy_type) {
3799         case B43_PHYTYPE_A:
3800                 if (phy_rev >= 4)
3801                         unsupported = 1;
3802                 break;
3803         case B43_PHYTYPE_B:
3804                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3805                     && phy_rev != 7)
3806                         unsupported = 1;
3807                 break;
3808         case B43_PHYTYPE_G:
3809                 if (phy_rev > 9)
3810                         unsupported = 1;
3811                 break;
3812 #ifdef CONFIG_B43_NPHY
3813         case B43_PHYTYPE_N:
3814                 if (phy_rev > 4)
3815                         unsupported = 1;
3816                 break;
3817 #endif
3818 #ifdef CONFIG_B43_PHY_LP
3819         case B43_PHYTYPE_LP:
3820                 if (phy_rev > 1)
3821                         unsupported = 1;
3822                 break;
3823 #endif
3824         default:
3825                 unsupported = 1;
3826         };
3827         if (unsupported) {
3828                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3829                        "(Analog %u, Type %u, Revision %u)\n",
3830                        analog_type, phy_type, phy_rev);
3831                 return -EOPNOTSUPP;
3832         }
3833         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3834                analog_type, phy_type, phy_rev);
3835
3836         /* Get RADIO versioning */
3837         if (dev->dev->bus->chip_id == 0x4317) {
3838                 if (dev->dev->bus->chip_rev == 0)
3839                         tmp = 0x3205017F;
3840                 else if (dev->dev->bus->chip_rev == 1)
3841                         tmp = 0x4205017F;
3842                 else
3843                         tmp = 0x5205017F;
3844         } else {
3845                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3846                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3847                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3848                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3849         }
3850         radio_manuf = (tmp & 0x00000FFF);
3851         radio_ver = (tmp & 0x0FFFF000) >> 12;
3852         radio_rev = (tmp & 0xF0000000) >> 28;
3853         if (radio_manuf != 0x17F /* Broadcom */)
3854                 unsupported = 1;
3855         switch (phy_type) {
3856         case B43_PHYTYPE_A:
3857                 if (radio_ver != 0x2060)
3858                         unsupported = 1;
3859                 if (radio_rev != 1)
3860                         unsupported = 1;
3861                 if (radio_manuf != 0x17F)
3862                         unsupported = 1;
3863                 break;
3864         case B43_PHYTYPE_B:
3865                 if ((radio_ver & 0xFFF0) != 0x2050)
3866                         unsupported = 1;
3867                 break;
3868         case B43_PHYTYPE_G:
3869                 if (radio_ver != 0x2050)
3870                         unsupported = 1;
3871                 break;
3872         case B43_PHYTYPE_N:
3873                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3874                         unsupported = 1;
3875                 break;
3876         case B43_PHYTYPE_LP:
3877                 if (radio_ver != 0x2062)
3878                         unsupported = 1;
3879                 break;
3880         default:
3881                 B43_WARN_ON(1);
3882         }
3883         if (unsupported) {
3884                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3885                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3886                        radio_manuf, radio_ver, radio_rev);
3887                 return -EOPNOTSUPP;
3888         }
3889         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3890                radio_manuf, radio_ver, radio_rev);
3891
3892         phy->radio_manuf = radio_manuf;
3893         phy->radio_ver = radio_ver;
3894         phy->radio_rev = radio_rev;
3895
3896         phy->analog = analog_type;
3897         phy->type = phy_type;
3898         phy->rev = phy_rev;
3899
3900         return 0;
3901 }
3902
3903 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3904                                       struct b43_phy *phy)
3905 {
3906         phy->hardware_power_control = !!modparam_hwpctl;
3907         phy->next_txpwr_check_time = jiffies;
3908         /* PHY TX errors counter. */
3909         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3910
3911 #if B43_DEBUG
3912         phy->phy_locked = 0;
3913         phy->radio_locked = 0;
3914 #endif
3915 }
3916
3917 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3918 {
3919         dev->dfq_valid = 0;
3920
3921         /* Assume the radio is enabled. If it's not enabled, the state will
3922          * immediately get fixed on the first periodic work run. */
3923         dev->radio_hw_enable = 1;
3924
3925         /* Stats */
3926         memset(&dev->stats, 0, sizeof(dev->stats));
3927
3928         setup_struct_phy_for_init(dev, &dev->phy);
3929
3930         /* IRQ related flags */
3931         dev->irq_reason = 0;
3932         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3933         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
3934         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
3935                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
3936
3937         dev->mac_suspended = 1;
3938
3939         /* Noise calculation context */
3940         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3941 }
3942
3943 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3944 {
3945         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3946         u64 hf;
3947
3948         if (!modparam_btcoex)
3949                 return;
3950         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3951                 return;
3952         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3953                 return;
3954
3955         hf = b43_hf_read(dev);
3956         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3957                 hf |= B43_HF_BTCOEXALT;
3958         else
3959                 hf |= B43_HF_BTCOEX;
3960         b43_hf_write(dev, hf);
3961 }
3962
3963 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3964 {
3965         if (!modparam_btcoex)
3966                 return;
3967         //TODO
3968 }
3969
3970 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3971 {
3972 #ifdef CONFIG_SSB_DRIVER_PCICORE
3973         struct ssb_bus *bus = dev->dev->bus;
3974         u32 tmp;
3975
3976         if (bus->pcicore.dev &&
3977             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3978             bus->pcicore.dev->id.revision <= 5) {
3979                 /* IMCFGLO timeouts workaround. */
3980                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3981                 tmp &= ~SSB_IMCFGLO_REQTO;
3982                 tmp &= ~SSB_IMCFGLO_SERTO;
3983                 switch (bus->bustype) {
3984                 case SSB_BUSTYPE_PCI:
3985                 case SSB_BUSTYPE_PCMCIA:
3986                         tmp |= 0x32;
3987                         break;
3988                 case SSB_BUSTYPE_SSB:
3989                         tmp |= 0x53;
3990                         break;
3991                 }
3992                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3993         }
3994 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3995 }
3996
3997 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3998 {
3999         u16 pu_delay;
4000
4001         /* The time value is in microseconds. */
4002         if (dev->phy.type == B43_PHYTYPE_A)
4003                 pu_delay = 3700;
4004         else
4005                 pu_delay = 1050;
4006         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4007                 pu_delay = 500;
4008         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4009                 pu_delay = max(pu_delay, (u16)2400);
4010
4011         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4012 }
4013
4014 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4015 static void b43_set_pretbtt(struct b43_wldev *dev)
4016 {
4017         u16 pretbtt;
4018
4019         /* The time value is in microseconds. */
4020         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4021                 pretbtt = 2;
4022         } else {
4023                 if (dev->phy.type == B43_PHYTYPE_A)
4024                         pretbtt = 120;
4025                 else
4026                         pretbtt = 250;
4027         }
4028         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4029         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4030 }
4031
4032 /* Shutdown a wireless core */
4033 /* Locking: wl->mutex */
4034 static void b43_wireless_core_exit(struct b43_wldev *dev)
4035 {
4036         u32 macctl;
4037
4038         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4039         if (b43_status(dev) != B43_STAT_INITIALIZED)
4040                 return;
4041         b43_set_status(dev, B43_STAT_UNINIT);
4042
4043         /* Stop the microcode PSM. */
4044         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4045         macctl &= ~B43_MACCTL_PSM_RUN;
4046         macctl |= B43_MACCTL_PSM_JMP0;
4047         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4048
4049         if (!dev->suspend_in_progress) {
4050                 b43_leds_exit(dev);
4051                 b43_rng_exit(dev->wl);
4052         }
4053         b43_dma_free(dev);
4054         b43_pio_free(dev);
4055         b43_chip_exit(dev);
4056         dev->phy.ops->switch_analog(dev, 0);
4057         if (dev->wl->current_beacon) {
4058                 dev_kfree_skb_any(dev->wl->current_beacon);
4059                 dev->wl->current_beacon = NULL;
4060         }
4061
4062         ssb_device_disable(dev->dev, 0);
4063         ssb_bus_may_powerdown(dev->dev->bus);
4064 }
4065
4066 /* Initialize a wireless core */
4067 static int b43_wireless_core_init(struct b43_wldev *dev)
4068 {
4069         struct b43_wl *wl = dev->wl;
4070         struct ssb_bus *bus = dev->dev->bus;
4071         struct ssb_sprom *sprom = &bus->sprom;
4072         struct b43_phy *phy = &dev->phy;
4073         int err;
4074         u64 hf;
4075         u32 tmp;
4076
4077         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4078
4079         err = ssb_bus_powerup(bus, 0);
4080         if (err)
4081                 goto out;
4082         if (!ssb_device_is_enabled(dev->dev)) {
4083                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4084                 b43_wireless_core_reset(dev, tmp);
4085         }
4086
4087         /* Reset all data structures. */
4088         setup_struct_wldev_for_init(dev);
4089         phy->ops->prepare_structs(dev);
4090
4091         /* Enable IRQ routing to this device. */
4092         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4093
4094         b43_imcfglo_timeouts_workaround(dev);
4095         b43_bluetooth_coext_disable(dev);
4096         if (phy->ops->prepare_hardware) {
4097                 err = phy->ops->prepare_hardware(dev);
4098                 if (err)
4099                         goto err_busdown;
4100         }
4101         err = b43_chip_init(dev);
4102         if (err)
4103                 goto err_busdown;
4104         b43_shm_write16(dev, B43_SHM_SHARED,
4105                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4106         hf = b43_hf_read(dev);
4107         if (phy->type == B43_PHYTYPE_G) {
4108                 hf |= B43_HF_SYMW;
4109                 if (phy->rev == 1)
4110                         hf |= B43_HF_GDCW;
4111                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4112                         hf |= B43_HF_OFDMPABOOST;
4113         }
4114         if (phy->radio_ver == 0x2050) {
4115                 if (phy->radio_rev == 6)
4116                         hf |= B43_HF_4318TSSI;
4117                 if (phy->radio_rev < 6)
4118                         hf |= B43_HF_VCORECALC;
4119         }
4120         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4121                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4122 #ifdef CONFIG_SSB_DRIVER_PCICORE
4123         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4124             (bus->pcicore.dev->id.revision <= 10))
4125                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4126 #endif
4127         hf &= ~B43_HF_SKCFPUP;
4128         b43_hf_write(dev, hf);
4129
4130         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4131                              B43_DEFAULT_LONG_RETRY_LIMIT);
4132         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4133         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4134
4135         /* Disable sending probe responses from firmware.
4136          * Setting the MaxTime to one usec will always trigger
4137          * a timeout, so we never send any probe resp.
4138          * A timeout of zero is infinite. */
4139         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4140
4141         b43_rate_memory_init(dev);
4142         b43_set_phytxctl_defaults(dev);
4143
4144         /* Minimum Contention Window */
4145         if (phy->type == B43_PHYTYPE_B) {
4146                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4147         } else {
4148                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4149         }
4150         /* Maximum Contention Window */
4151         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4152
4153         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4154                 dev->__using_pio_transfers = 1;
4155                 err = b43_pio_init(dev);
4156         } else {
4157                 dev->__using_pio_transfers = 0;
4158                 err = b43_dma_init(dev);
4159         }
4160         if (err)
4161                 goto err_chip_exit;
4162         b43_qos_init(dev);
4163         b43_set_synth_pu_delay(dev, 1);
4164         b43_bluetooth_coext_enable(dev);
4165
4166         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4167         b43_upload_card_macaddress(dev);
4168         b43_security_init(dev);
4169         if (!dev->suspend_in_progress)
4170                 b43_rng_init(wl);
4171
4172         b43_set_status(dev, B43_STAT_INITIALIZED);
4173
4174         if (!dev->suspend_in_progress)
4175                 b43_leds_init(dev);
4176 out:
4177         return err;
4178
4179 err_chip_exit:
4180         b43_chip_exit(dev);
4181 err_busdown:
4182         ssb_bus_may_powerdown(bus);
4183         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4184         return err;
4185 }
4186
4187 static int b43_op_add_interface(struct ieee80211_hw *hw,
4188                                 struct ieee80211_if_init_conf *conf)
4189 {
4190         struct b43_wl *wl = hw_to_b43_wl(hw);
4191         struct b43_wldev *dev;
4192         unsigned long flags;
4193         int err = -EOPNOTSUPP;
4194
4195         /* TODO: allow WDS/AP devices to coexist */
4196
4197         if (conf->type != NL80211_IFTYPE_AP &&
4198             conf->type != NL80211_IFTYPE_MESH_POINT &&
4199             conf->type != NL80211_IFTYPE_STATION &&
4200             conf->type != NL80211_IFTYPE_WDS &&
4201             conf->type != NL80211_IFTYPE_ADHOC)
4202                 return -EOPNOTSUPP;
4203
4204         mutex_lock(&wl->mutex);
4205         if (wl->operating)
4206                 goto out_mutex_unlock;
4207
4208         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4209
4210         dev = wl->current_dev;
4211         wl->operating = 1;
4212         wl->vif = conf->vif;
4213         wl->if_type = conf->type;
4214         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4215
4216         spin_lock_irqsave(&wl->irq_lock, flags);
4217         b43_adjust_opmode(dev);
4218         b43_set_pretbtt(dev);
4219         b43_set_synth_pu_delay(dev, 0);
4220         b43_upload_card_macaddress(dev);
4221         spin_unlock_irqrestore(&wl->irq_lock, flags);
4222
4223         err = 0;
4224  out_mutex_unlock:
4225         mutex_unlock(&wl->mutex);
4226
4227         return err;
4228 }
4229
4230 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4231                                     struct ieee80211_if_init_conf *conf)
4232 {
4233         struct b43_wl *wl = hw_to_b43_wl(hw);
4234         struct b43_wldev *dev = wl->current_dev;
4235         unsigned long flags;
4236
4237         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4238
4239         mutex_lock(&wl->mutex);
4240
4241         B43_WARN_ON(!wl->operating);
4242         B43_WARN_ON(wl->vif != conf->vif);
4243         wl->vif = NULL;
4244
4245         wl->operating = 0;
4246
4247         spin_lock_irqsave(&wl->irq_lock, flags);
4248         b43_adjust_opmode(dev);
4249         memset(wl->mac_addr, 0, ETH_ALEN);
4250         b43_upload_card_macaddress(dev);
4251         spin_unlock_irqrestore(&wl->irq_lock, flags);
4252
4253         mutex_unlock(&wl->mutex);
4254 }
4255
4256 static int b43_op_start(struct ieee80211_hw *hw)
4257 {
4258         struct b43_wl *wl = hw_to_b43_wl(hw);
4259         struct b43_wldev *dev = wl->current_dev;
4260         int did_init = 0;
4261         int err = 0;
4262
4263         /* Kill all old instance specific information to make sure
4264          * the card won't use it in the short timeframe between start
4265          * and mac80211 reconfiguring it. */
4266         memset(wl->bssid, 0, ETH_ALEN);
4267         memset(wl->mac_addr, 0, ETH_ALEN);
4268         wl->filter_flags = 0;
4269         wl->radiotap_enabled = 0;
4270         b43_qos_clear(wl);
4271         wl->beacon0_uploaded = 0;
4272         wl->beacon1_uploaded = 0;
4273         wl->beacon_templates_virgin = 1;
4274         wl->radio_enabled = 1;
4275
4276         mutex_lock(&wl->mutex);
4277
4278         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4279                 err = b43_wireless_core_init(dev);
4280                 if (err)
4281                         goto out_mutex_unlock;
4282                 did_init = 1;
4283         }
4284
4285         if (b43_status(dev) < B43_STAT_STARTED) {
4286                 err = b43_wireless_core_start(dev);
4287                 if (err) {
4288                         if (did_init)
4289                                 b43_wireless_core_exit(dev);
4290                         goto out_mutex_unlock;
4291                 }
4292         }
4293
4294         /* XXX: only do if device doesn't support rfkill irq */
4295         wiphy_rfkill_start_polling(hw->wiphy);
4296
4297  out_mutex_unlock:
4298         mutex_unlock(&wl->mutex);
4299
4300         return err;
4301 }
4302
4303 static void b43_op_stop(struct ieee80211_hw *hw)
4304 {
4305         struct b43_wl *wl = hw_to_b43_wl(hw);
4306         struct b43_wldev *dev = wl->current_dev;
4307
4308         cancel_work_sync(&(wl->beacon_update_trigger));
4309
4310         mutex_lock(&wl->mutex);
4311         if (b43_status(dev) >= B43_STAT_STARTED)
4312                 b43_wireless_core_stop(dev);
4313         b43_wireless_core_exit(dev);
4314         wl->radio_enabled = 0;
4315         mutex_unlock(&wl->mutex);
4316
4317         cancel_work_sync(&(wl->txpower_adjust_work));
4318 }
4319
4320 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4321                                  struct ieee80211_sta *sta, bool set)
4322 {
4323         struct b43_wl *wl = hw_to_b43_wl(hw);
4324         unsigned long flags;
4325
4326         spin_lock_irqsave(&wl->irq_lock, flags);
4327         b43_update_templates(wl);
4328         spin_unlock_irqrestore(&wl->irq_lock, flags);
4329
4330         return 0;
4331 }
4332
4333 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4334                               struct ieee80211_vif *vif,
4335                               enum sta_notify_cmd notify_cmd,
4336                               struct ieee80211_sta *sta)
4337 {
4338         struct b43_wl *wl = hw_to_b43_wl(hw);
4339
4340         B43_WARN_ON(!vif || wl->vif != vif);
4341 }
4342
4343 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4344 {
4345         struct b43_wl *wl = hw_to_b43_wl(hw);
4346         struct b43_wldev *dev;
4347
4348         mutex_lock(&wl->mutex);
4349         dev = wl->current_dev;
4350         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4351                 /* Disable CFP update during scan on other channels. */
4352                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4353         }
4354         mutex_unlock(&wl->mutex);
4355 }
4356
4357 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4358 {
4359         struct b43_wl *wl = hw_to_b43_wl(hw);
4360         struct b43_wldev *dev;
4361
4362         mutex_lock(&wl->mutex);
4363         dev = wl->current_dev;
4364         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4365                 /* Re-enable CFP update. */
4366                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4367         }
4368         mutex_unlock(&wl->mutex);
4369 }
4370
4371 static const struct ieee80211_ops b43_hw_ops = {
4372         .tx                     = b43_op_tx,
4373         .conf_tx                = b43_op_conf_tx,
4374         .add_interface          = b43_op_add_interface,
4375         .remove_interface       = b43_op_remove_interface,
4376         .config                 = b43_op_config,
4377         .bss_info_changed       = b43_op_bss_info_changed,
4378         .configure_filter       = b43_op_configure_filter,
4379         .set_key                = b43_op_set_key,
4380         .get_stats              = b43_op_get_stats,
4381         .get_tx_stats           = b43_op_get_tx_stats,
4382         .get_tsf                = b43_op_get_tsf,
4383         .set_tsf                = b43_op_set_tsf,
4384         .start                  = b43_op_start,
4385         .stop                   = b43_op_stop,
4386         .set_tim                = b43_op_beacon_set_tim,
4387         .sta_notify             = b43_op_sta_notify,
4388         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4389         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4390         .rfkill_poll            = b43_rfkill_poll,
4391 };
4392
4393 /* Hard-reset the chip. Do not call this directly.
4394  * Use b43_controller_restart()
4395  */
4396 static void b43_chip_reset(struct work_struct *work)
4397 {
4398         struct b43_wldev *dev =
4399             container_of(work, struct b43_wldev, restart_work);
4400         struct b43_wl *wl = dev->wl;
4401         int err = 0;
4402         int prev_status;
4403
4404         mutex_lock(&wl->mutex);
4405
4406         prev_status = b43_status(dev);
4407         /* Bring the device down... */
4408         if (prev_status >= B43_STAT_STARTED)
4409                 b43_wireless_core_stop(dev);
4410         if (prev_status >= B43_STAT_INITIALIZED)
4411                 b43_wireless_core_exit(dev);
4412
4413         /* ...and up again. */
4414         if (prev_status >= B43_STAT_INITIALIZED) {
4415                 err = b43_wireless_core_init(dev);
4416                 if (err)
4417                         goto out;
4418         }
4419         if (prev_status >= B43_STAT_STARTED) {
4420                 err = b43_wireless_core_start(dev);
4421                 if (err) {
4422                         b43_wireless_core_exit(dev);
4423                         goto out;
4424                 }
4425         }
4426 out:
4427         if (err)
4428                 wl->current_dev = NULL; /* Failed to init the dev. */
4429         mutex_unlock(&wl->mutex);
4430         if (err)
4431                 b43err(wl, "Controller restart FAILED\n");
4432         else
4433                 b43info(wl, "Controller restarted\n");
4434 }
4435
4436 static int b43_setup_bands(struct b43_wldev *dev,
4437                            bool have_2ghz_phy, bool have_5ghz_phy)
4438 {
4439         struct ieee80211_hw *hw = dev->wl->hw;
4440
4441         if (have_2ghz_phy)
4442                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4443         if (dev->phy.type == B43_PHYTYPE_N) {
4444                 if (have_5ghz_phy)
4445                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4446         } else {
4447                 if (have_5ghz_phy)
4448                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4449         }
4450
4451         dev->phy.supports_2ghz = have_2ghz_phy;
4452         dev->phy.supports_5ghz = have_5ghz_phy;
4453
4454         return 0;
4455 }
4456
4457 static void b43_wireless_core_detach(struct b43_wldev *dev)
4458 {
4459         /* We release firmware that late to not be required to re-request
4460          * is all the time when we reinit the core. */
4461         b43_release_firmware(dev);
4462         b43_phy_free(dev);
4463 }
4464
4465 static int b43_wireless_core_attach(struct b43_wldev *dev)
4466 {
4467         struct b43_wl *wl = dev->wl;
4468         struct ssb_bus *bus = dev->dev->bus;
4469         struct pci_dev *pdev = bus->host_pci;
4470         int err;
4471         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4472         u32 tmp;
4473
4474         /* Do NOT do any device initialization here.
4475          * Do it in wireless_core_init() instead.
4476          * This function is for gathering basic information about the HW, only.
4477          * Also some structs may be set up here. But most likely you want to have
4478          * that in core_init(), too.
4479          */
4480
4481         err = ssb_bus_powerup(bus, 0);
4482         if (err) {
4483                 b43err(wl, "Bus powerup failed\n");
4484                 goto out;
4485         }
4486         /* Get the PHY type. */
4487         if (dev->dev->id.revision >= 5) {
4488                 u32 tmshigh;
4489
4490                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4491                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4492                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4493         } else
4494                 B43_WARN_ON(1);
4495
4496         dev->phy.gmode = have_2ghz_phy;
4497         dev->phy.radio_on = 1;
4498         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4499         b43_wireless_core_reset(dev, tmp);
4500
4501         err = b43_phy_versioning(dev);
4502         if (err)
4503                 goto err_powerdown;
4504         /* Check if this device supports multiband. */
4505         if (!pdev ||
4506             (pdev->device != 0x4312 &&
4507              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4508                 /* No multiband support. */
4509                 have_2ghz_phy = 0;
4510                 have_5ghz_phy = 0;
4511                 switch (dev->phy.type) {
4512                 case B43_PHYTYPE_A:
4513                         have_5ghz_phy = 1;
4514                         break;
4515                 case B43_PHYTYPE_G:
4516                 case B43_PHYTYPE_N:
4517                 case B43_PHYTYPE_LP:
4518                         have_2ghz_phy = 1;
4519                         break;
4520                 default:
4521                         B43_WARN_ON(1);
4522                 }
4523         }
4524         if (dev->phy.type == B43_PHYTYPE_A) {
4525                 /* FIXME */
4526                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4527                 err = -EOPNOTSUPP;
4528                 goto err_powerdown;
4529         }
4530         if (1 /* disable A-PHY */) {
4531                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4532                 if (dev->phy.type != B43_PHYTYPE_N) {
4533                         have_2ghz_phy = 1;
4534                         have_5ghz_phy = 0;
4535                 }
4536         }
4537
4538         err = b43_phy_allocate(dev);
4539         if (err)
4540                 goto err_powerdown;
4541
4542         dev->phy.gmode = have_2ghz_phy;
4543         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4544         b43_wireless_core_reset(dev, tmp);
4545
4546         err = b43_validate_chipaccess(dev);
4547         if (err)
4548                 goto err_phy_free;
4549         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4550         if (err)
4551                 goto err_phy_free;
4552
4553         /* Now set some default "current_dev" */
4554         if (!wl->current_dev)
4555                 wl->current_dev = dev;
4556         INIT_WORK(&dev->restart_work, b43_chip_reset);
4557
4558         dev->phy.ops->switch_analog(dev, 0);
4559         ssb_device_disable(dev->dev, 0);
4560         ssb_bus_may_powerdown(bus);
4561
4562 out:
4563         return err;
4564
4565 err_phy_free:
4566         b43_phy_free(dev);
4567 err_powerdown:
4568         ssb_bus_may_powerdown(bus);
4569         return err;
4570 }
4571
4572 static void b43_one_core_detach(struct ssb_device *dev)
4573 {
4574         struct b43_wldev *wldev;
4575         struct b43_wl *wl;
4576
4577         /* Do not cancel ieee80211-workqueue based work here.
4578          * See comment in b43_remove(). */
4579
4580         wldev = ssb_get_drvdata(dev);
4581         wl = wldev->wl;
4582         b43_debugfs_remove_device(wldev);
4583         b43_wireless_core_detach(wldev);
4584         list_del(&wldev->list);
4585         wl->nr_devs--;
4586         ssb_set_drvdata(dev, NULL);
4587         kfree(wldev);
4588 }
4589
4590 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4591 {
4592         struct b43_wldev *wldev;
4593         struct pci_dev *pdev;
4594         int err = -ENOMEM;
4595
4596         if (!list_empty(&wl->devlist)) {
4597                 /* We are not the first core on this chip. */
4598                 pdev = dev->bus->host_pci;
4599                 /* Only special chips support more than one wireless
4600                  * core, although some of the other chips have more than
4601                  * one wireless core as well. Check for this and
4602                  * bail out early.
4603                  */
4604                 if (!pdev ||
4605                     ((pdev->device != 0x4321) &&
4606                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4607                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4608                         return -ENODEV;
4609                 }
4610         }
4611
4612         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4613         if (!wldev)
4614                 goto out;
4615
4616         wldev->dev = dev;
4617         wldev->wl = wl;
4618         b43_set_status(wldev, B43_STAT_UNINIT);
4619         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4620         tasklet_init(&wldev->isr_tasklet,
4621                      (void (*)(unsigned long))b43_interrupt_tasklet,
4622                      (unsigned long)wldev);
4623         INIT_LIST_HEAD(&wldev->list);
4624
4625         err = b43_wireless_core_attach(wldev);
4626         if (err)
4627                 goto err_kfree_wldev;
4628
4629         list_add(&wldev->list, &wl->devlist);
4630         wl->nr_devs++;
4631         ssb_set_drvdata(dev, wldev);
4632         b43_debugfs_add_device(wldev);
4633
4634       out:
4635         return err;
4636
4637       err_kfree_wldev:
4638         kfree(wldev);
4639         return err;
4640 }
4641
4642 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4643         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4644         (pdev->device == _device) &&                                    \
4645         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4646         (pdev->subsystem_device == _subdevice)                          )
4647
4648 static void b43_sprom_fixup(struct ssb_bus *bus)
4649 {
4650         struct pci_dev *pdev;
4651
4652         /* boardflags workarounds */
4653         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4654             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4655                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4656         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4657             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4658                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4659         if (bus->bustype == SSB_BUSTYPE_PCI) {
4660                 pdev = bus->host_pci;
4661                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4662                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4663                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4664                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4665                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4666                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4667                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4668                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4669         }
4670 }
4671
4672 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4673 {
4674         struct ieee80211_hw *hw = wl->hw;
4675
4676         ssb_set_devtypedata(dev, NULL);
4677         ieee80211_free_hw(hw);
4678 }
4679
4680 static int b43_wireless_init(struct ssb_device *dev)
4681 {
4682         struct ssb_sprom *sprom = &dev->bus->sprom;
4683         struct ieee80211_hw *hw;
4684         struct b43_wl *wl;
4685         int err = -ENOMEM;
4686
4687         b43_sprom_fixup(dev->bus);
4688
4689         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4690         if (!hw) {
4691                 b43err(NULL, "Could not allocate ieee80211 device\n");
4692                 goto out;
4693         }
4694         wl = hw_to_b43_wl(hw);
4695
4696         /* fill hw info */
4697         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4698                     IEEE80211_HW_SIGNAL_DBM |
4699                     IEEE80211_HW_NOISE_DBM;
4700
4701         hw->wiphy->interface_modes =
4702                 BIT(NL80211_IFTYPE_AP) |
4703                 BIT(NL80211_IFTYPE_MESH_POINT) |
4704                 BIT(NL80211_IFTYPE_STATION) |
4705                 BIT(NL80211_IFTYPE_WDS) |
4706                 BIT(NL80211_IFTYPE_ADHOC);
4707
4708         hw->queues = modparam_qos ? 4 : 1;
4709         wl->mac80211_initially_registered_queues = hw->queues;
4710         hw->max_rates = 2;
4711         SET_IEEE80211_DEV(hw, dev->dev);
4712         if (is_valid_ether_addr(sprom->et1mac))
4713                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4714         else
4715                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4716
4717         /* Initialize struct b43_wl */
4718         wl->hw = hw;
4719         spin_lock_init(&wl->irq_lock);
4720         rwlock_init(&wl->tx_lock);
4721         spin_lock_init(&wl->leds_lock);
4722         spin_lock_init(&wl->shm_lock);
4723         mutex_init(&wl->mutex);
4724         INIT_LIST_HEAD(&wl->devlist);
4725         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4726         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4727
4728         ssb_set_devtypedata(dev, wl);
4729         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4730                 dev->bus->chip_id, dev->id.revision);
4731         err = 0;
4732 out:
4733         return err;
4734 }
4735
4736 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4737 {
4738         struct b43_wl *wl;
4739         int err;
4740         int first = 0;
4741
4742         wl = ssb_get_devtypedata(dev);
4743         if (!wl) {
4744                 /* Probing the first core. Must setup common struct b43_wl */
4745                 first = 1;
4746                 err = b43_wireless_init(dev);
4747                 if (err)
4748                         goto out;
4749                 wl = ssb_get_devtypedata(dev);
4750                 B43_WARN_ON(!wl);
4751         }
4752         err = b43_one_core_attach(dev, wl);
4753         if (err)
4754                 goto err_wireless_exit;
4755
4756         if (first) {
4757                 err = ieee80211_register_hw(wl->hw);
4758                 if (err)
4759                         goto err_one_core_detach;
4760         }
4761
4762       out:
4763         return err;
4764
4765       err_one_core_detach:
4766         b43_one_core_detach(dev);
4767       err_wireless_exit:
4768         if (first)
4769                 b43_wireless_exit(dev, wl);
4770         return err;
4771 }
4772
4773 static void b43_remove(struct ssb_device *dev)
4774 {
4775         struct b43_wl *wl = ssb_get_devtypedata(dev);
4776         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4777
4778         /* We must cancel any work here before unregistering from ieee80211,
4779          * as the ieee80211 unreg will destroy the workqueue. */
4780         cancel_work_sync(&wldev->restart_work);
4781
4782         B43_WARN_ON(!wl);
4783         if (wl->current_dev == wldev) {
4784                 /* Restore the queues count before unregistering, because firmware detect
4785                  * might have modified it. Restoring is important, so the networking
4786                  * stack can properly free resources. */
4787                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4788                 ieee80211_unregister_hw(wl->hw);
4789         }
4790
4791         b43_one_core_detach(dev);
4792
4793         if (list_empty(&wl->devlist)) {
4794                 /* Last core on the chip unregistered.
4795                  * We can destroy common struct b43_wl.
4796                  */
4797                 b43_wireless_exit(dev, wl);
4798         }
4799 }
4800
4801 /* Perform a hardware reset. This can be called from any context. */
4802 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4803 {
4804         /* Must avoid requeueing, if we are in shutdown. */
4805         if (b43_status(dev) < B43_STAT_INITIALIZED)
4806                 return;
4807         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4808         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4809 }
4810
4811 #ifdef CONFIG_PM
4812
4813 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4814 {
4815         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4816         struct b43_wl *wl = wldev->wl;
4817
4818         b43dbg(wl, "Suspending...\n");
4819
4820         mutex_lock(&wl->mutex);
4821         wldev->suspend_in_progress = true;
4822         wldev->suspend_init_status = b43_status(wldev);
4823         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4824                 b43_wireless_core_stop(wldev);
4825         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4826                 b43_wireless_core_exit(wldev);
4827         mutex_unlock(&wl->mutex);
4828
4829         b43dbg(wl, "Device suspended.\n");
4830
4831         return 0;
4832 }
4833
4834 static int b43_resume(struct ssb_device *dev)
4835 {
4836         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4837         struct b43_wl *wl = wldev->wl;
4838         int err = 0;
4839
4840         b43dbg(wl, "Resuming...\n");
4841
4842         mutex_lock(&wl->mutex);
4843         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4844                 err = b43_wireless_core_init(wldev);
4845                 if (err) {
4846                         b43err(wl, "Resume failed at core init\n");
4847                         goto out;
4848                 }
4849         }
4850         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4851                 err = b43_wireless_core_start(wldev);
4852                 if (err) {
4853                         b43_leds_exit(wldev);
4854                         b43_rng_exit(wldev->wl);
4855                         b43_wireless_core_exit(wldev);
4856                         b43err(wl, "Resume failed at core start\n");
4857                         goto out;
4858                 }
4859         }
4860         b43dbg(wl, "Device resumed.\n");
4861  out:
4862         wldev->suspend_in_progress = false;
4863         mutex_unlock(&wl->mutex);
4864         return err;
4865 }
4866
4867 #else /* CONFIG_PM */
4868 # define b43_suspend    NULL
4869 # define b43_resume     NULL
4870 #endif /* CONFIG_PM */
4871
4872 static struct ssb_driver b43_ssb_driver = {
4873         .name           = KBUILD_MODNAME,
4874         .id_table       = b43_ssb_tbl,
4875         .probe          = b43_probe,
4876         .remove         = b43_remove,
4877         .suspend        = b43_suspend,
4878         .resume         = b43_resume,
4879 };
4880
4881 static void b43_print_driverinfo(void)
4882 {
4883         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4884                    *feat_leds = "";
4885
4886 #ifdef CONFIG_B43_PCI_AUTOSELECT
4887         feat_pci = "P";
4888 #endif
4889 #ifdef CONFIG_B43_PCMCIA
4890         feat_pcmcia = "M";
4891 #endif
4892 #ifdef CONFIG_B43_NPHY
4893         feat_nphy = "N";
4894 #endif
4895 #ifdef CONFIG_B43_LEDS
4896         feat_leds = "L";
4897 #endif
4898         printk(KERN_INFO "Broadcom 43xx driver loaded "
4899                "[ Features: %s%s%s%s, Firmware-ID: "
4900                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4901                feat_pci, feat_pcmcia, feat_nphy,
4902                feat_leds);
4903 }
4904
4905 static int __init b43_init(void)
4906 {
4907         int err;
4908
4909         b43_debugfs_init();
4910         err = b43_pcmcia_init();
4911         if (err)
4912                 goto err_dfs_exit;
4913         err = ssb_driver_register(&b43_ssb_driver);
4914         if (err)
4915                 goto err_pcmcia_exit;
4916         b43_print_driverinfo();
4917
4918         return err;
4919
4920 err_pcmcia_exit:
4921         b43_pcmcia_exit();
4922 err_dfs_exit:
4923         b43_debugfs_exit();
4924         return err;
4925 }
4926
4927 static void __exit b43_exit(void)
4928 {
4929         ssb_driver_unregister(&b43_ssb_driver);
4930         b43_pcmcia_exit();
4931         b43_debugfs_exit();
4932 }
4933
4934 module_init(b43_init)
4935 module_exit(b43_exit)