drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1160 {
1161         u32 flags;
1162
1163         /* Put PHY into reset */
1164         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1165         flags |= B43_BCMA_IOCTL_PHY_RESET;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1168         udelay(2);
1169
1170         /* Take PHY out of reset */
1171         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1172         flags &= ~B43_BCMA_IOCTL_PHY_RESET;
1173         flags |= BCMA_IOCTL_FGC;
1174         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1175         udelay(1);
1176
1177         /* Do not force clock anymore */
1178         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1179         flags &= ~BCMA_IOCTL_FGC;
1180         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1181         udelay(1);
1182 }
1183
1184 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1185 {
1186         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
1187         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1188         b43_bcma_phy_reset(dev);
1189         bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
1190 }
1191 #endif
1192
1193 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1194 {
1195         struct ssb_device *sdev = dev->dev->sdev;
1196         u32 tmslow;
1197         u32 flags = 0;
1198
1199         if (gmode)
1200                 flags |= B43_TMSLOW_GMODE;
1201         flags |= B43_TMSLOW_PHYCLKEN;
1202         flags |= B43_TMSLOW_PHYRESET;
1203         if (dev->phy.type == B43_PHYTYPE_N)
1204                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1205         b43_device_enable(dev, flags);
1206         msleep(2);              /* Wait for the PLL to turn on. */
1207
1208         /* Now take the PHY out of Reset again */
1209         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1210         tmslow |= SSB_TMSLOW_FGC;
1211         tmslow &= ~B43_TMSLOW_PHYRESET;
1212         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1213         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1214         msleep(1);
1215         tmslow &= ~SSB_TMSLOW_FGC;
1216         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1217         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1218         msleep(1);
1219 }
1220
1221 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1222 {
1223         u32 macctl;
1224
1225         switch (dev->dev->bus_type) {
1226 #ifdef CONFIG_B43_BCMA
1227         case B43_BUS_BCMA:
1228                 b43_bcma_wireless_core_reset(dev, gmode);
1229                 break;
1230 #endif
1231 #ifdef CONFIG_B43_SSB
1232         case B43_BUS_SSB:
1233                 b43_ssb_wireless_core_reset(dev, gmode);
1234                 break;
1235 #endif
1236         }
1237
1238         /* Turn Analog ON, but only if we already know the PHY-type.
1239          * This protects against very early setup where we don't know the
1240          * PHY-type, yet. wireless_core_reset will be called once again later,
1241          * when we know the PHY-type. */
1242         if (dev->phy.ops)
1243                 dev->phy.ops->switch_analog(dev, 1);
1244
1245         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1246         macctl &= ~B43_MACCTL_GMODE;
1247         if (gmode)
1248                 macctl |= B43_MACCTL_GMODE;
1249         macctl |= B43_MACCTL_IHR_ENABLED;
1250         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1251 }
1252
1253 static void handle_irq_transmit_status(struct b43_wldev *dev)
1254 {
1255         u32 v0, v1;
1256         u16 tmp;
1257         struct b43_txstatus stat;
1258
1259         while (1) {
1260                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1261                 if (!(v0 & 0x00000001))
1262                         break;
1263                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1264
1265                 stat.cookie = (v0 >> 16);
1266                 stat.seq = (v1 & 0x0000FFFF);
1267                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1268                 tmp = (v0 & 0x0000FFFF);
1269                 stat.frame_count = ((tmp & 0xF000) >> 12);
1270                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1271                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1272                 stat.pm_indicated = !!(tmp & 0x0080);
1273                 stat.intermediate = !!(tmp & 0x0040);
1274                 stat.for_ampdu = !!(tmp & 0x0020);
1275                 stat.acked = !!(tmp & 0x0002);
1276
1277                 b43_handle_txstatus(dev, &stat);
1278         }
1279 }
1280
1281 static void drain_txstatus_queue(struct b43_wldev *dev)
1282 {
1283         u32 dummy;
1284
1285         if (dev->dev->core_rev < 5)
1286                 return;
1287         /* Read all entries from the microcode TXstatus FIFO
1288          * and throw them away.
1289          */
1290         while (1) {
1291                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1292                 if (!(dummy & 0x00000001))
1293                         break;
1294                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1295         }
1296 }
1297
1298 static u32 b43_jssi_read(struct b43_wldev *dev)
1299 {
1300         u32 val = 0;
1301
1302         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1303         val <<= 16;
1304         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1305
1306         return val;
1307 }
1308
1309 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1310 {
1311         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1312         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1313 }
1314
1315 static void b43_generate_noise_sample(struct b43_wldev *dev)
1316 {
1317         b43_jssi_write(dev, 0x7F7F7F7F);
1318         b43_write32(dev, B43_MMIO_MACCMD,
1319                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1320 }
1321
1322 static void b43_calculate_link_quality(struct b43_wldev *dev)
1323 {
1324         /* Top half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328         if (dev->noisecalc.calculation_running)
1329                 return;
1330         dev->noisecalc.calculation_running = 1;
1331         dev->noisecalc.nr_samples = 0;
1332
1333         b43_generate_noise_sample(dev);
1334 }
1335
1336 static void handle_irq_noise(struct b43_wldev *dev)
1337 {
1338         struct b43_phy_g *phy = dev->phy.g;
1339         u16 tmp;
1340         u8 noise[4];
1341         u8 i, j;
1342         s32 average;
1343
1344         /* Bottom half of Link Quality calculation. */
1345
1346         if (dev->phy.type != B43_PHYTYPE_G)
1347                 return;
1348
1349         /* Possible race condition: It might be possible that the user
1350          * changed to a different channel in the meantime since we
1351          * started the calculation. We ignore that fact, since it's
1352          * not really that much of a problem. The background noise is
1353          * an estimation only anyway. Slightly wrong results will get damped
1354          * by the averaging of the 8 sample rounds. Additionally the
1355          * value is shortlived. So it will be replaced by the next noise
1356          * calculation round soon. */
1357
1358         B43_WARN_ON(!dev->noisecalc.calculation_running);
1359         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1360         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1361             noise[2] == 0x7F || noise[3] == 0x7F)
1362                 goto generate_new;
1363
1364         /* Get the noise samples. */
1365         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1366         i = dev->noisecalc.nr_samples;
1367         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1368         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1369         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1370         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1371         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1372         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1373         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1374         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1375         dev->noisecalc.nr_samples++;
1376         if (dev->noisecalc.nr_samples == 8) {
1377                 /* Calculate the Link Quality by the noise samples. */
1378                 average = 0;
1379                 for (i = 0; i < 8; i++) {
1380                         for (j = 0; j < 4; j++)
1381                                 average += dev->noisecalc.samples[i][j];
1382                 }
1383                 average /= (8 * 4);
1384                 average *= 125;
1385                 average += 64;
1386                 average /= 128;
1387                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1388                 tmp = (tmp / 128) & 0x1F;
1389                 if (tmp >= 8)
1390                         average += 2;
1391                 else
1392                         average -= 25;
1393                 if (tmp == 8)
1394                         average -= 72;
1395                 else
1396                         average -= 48;
1397
1398                 dev->stats.link_noise = average;
1399                 dev->noisecalc.calculation_running = 0;
1400                 return;
1401         }
1402 generate_new:
1403         b43_generate_noise_sample(dev);
1404 }
1405
1406 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1407 {
1408         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1409                 ///TODO: PS TBTT
1410         } else {
1411                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1412                         b43_power_saving_ctl_bits(dev, 0);
1413         }
1414         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1415                 dev->dfq_valid = 1;
1416 }
1417
1418 static void handle_irq_atim_end(struct b43_wldev *dev)
1419 {
1420         if (dev->dfq_valid) {
1421                 b43_write32(dev, B43_MMIO_MACCMD,
1422                             b43_read32(dev, B43_MMIO_MACCMD)
1423                             | B43_MACCMD_DFQ_VALID);
1424                 dev->dfq_valid = 0;
1425         }
1426 }
1427
1428 static void handle_irq_pmq(struct b43_wldev *dev)
1429 {
1430         u32 tmp;
1431
1432         //TODO: AP mode.
1433
1434         while (1) {
1435                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1436                 if (!(tmp & 0x00000008))
1437                         break;
1438         }
1439         /* 16bit write is odd, but correct. */
1440         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1441 }
1442
1443 static void b43_write_template_common(struct b43_wldev *dev,
1444                                       const u8 *data, u16 size,
1445                                       u16 ram_offset,
1446                                       u16 shm_size_offset, u8 rate)
1447 {
1448         u32 i, tmp;
1449         struct b43_plcp_hdr4 plcp;
1450
1451         plcp.data = 0;
1452         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1453         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1454         ram_offset += sizeof(u32);
1455         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1456          * So leave the first two bytes of the next write blank.
1457          */
1458         tmp = (u32) (data[0]) << 16;
1459         tmp |= (u32) (data[1]) << 24;
1460         b43_ram_write(dev, ram_offset, tmp);
1461         ram_offset += sizeof(u32);
1462         for (i = 2; i < size; i += sizeof(u32)) {
1463                 tmp = (u32) (data[i + 0]);
1464                 if (i + 1 < size)
1465                         tmp |= (u32) (data[i + 1]) << 8;
1466                 if (i + 2 < size)
1467                         tmp |= (u32) (data[i + 2]) << 16;
1468                 if (i + 3 < size)
1469                         tmp |= (u32) (data[i + 3]) << 24;
1470                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1471         }
1472         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1473                         size + sizeof(struct b43_plcp_hdr6));
1474 }
1475
1476 /* Check if the use of the antenna that ieee80211 told us to
1477  * use is possible. This will fall back to DEFAULT.
1478  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1479 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1480                                   u8 antenna_nr)
1481 {
1482         u8 antenna_mask;
1483
1484         if (antenna_nr == 0) {
1485                 /* Zero means "use default antenna". That's always OK. */
1486                 return 0;
1487         }
1488
1489         /* Get the mask of available antennas. */
1490         if (dev->phy.gmode)
1491                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1492         else
1493                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1494
1495         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1496                 /* This antenna is not available. Fall back to default. */
1497                 return 0;
1498         }
1499
1500         return antenna_nr;
1501 }
1502
1503 /* Convert a b43 antenna number value to the PHY TX control value. */
1504 static u16 b43_antenna_to_phyctl(int antenna)
1505 {
1506         switch (antenna) {
1507         case B43_ANTENNA0:
1508                 return B43_TXH_PHY_ANT0;
1509         case B43_ANTENNA1:
1510                 return B43_TXH_PHY_ANT1;
1511         case B43_ANTENNA2:
1512                 return B43_TXH_PHY_ANT2;
1513         case B43_ANTENNA3:
1514                 return B43_TXH_PHY_ANT3;
1515         case B43_ANTENNA_AUTO0:
1516         case B43_ANTENNA_AUTO1:
1517                 return B43_TXH_PHY_ANT01AUTO;
1518         }
1519         B43_WARN_ON(1);
1520         return 0;
1521 }
1522
1523 static void b43_write_beacon_template(struct b43_wldev *dev,
1524                                       u16 ram_offset,
1525                                       u16 shm_size_offset)
1526 {
1527         unsigned int i, len, variable_len;
1528         const struct ieee80211_mgmt *bcn;
1529         const u8 *ie;
1530         bool tim_found = 0;
1531         unsigned int rate;
1532         u16 ctl;
1533         int antenna;
1534         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1535
1536         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1537         len = min((size_t) dev->wl->current_beacon->len,
1538                   0x200 - sizeof(struct b43_plcp_hdr6));
1539         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1540
1541         b43_write_template_common(dev, (const u8 *)bcn,
1542                                   len, ram_offset, shm_size_offset, rate);
1543
1544         /* Write the PHY TX control parameters. */
1545         antenna = B43_ANTENNA_DEFAULT;
1546         antenna = b43_antenna_to_phyctl(antenna);
1547         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1548         /* We can't send beacons with short preamble. Would get PHY errors. */
1549         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1550         ctl &= ~B43_TXH_PHY_ANT;
1551         ctl &= ~B43_TXH_PHY_ENC;
1552         ctl |= antenna;
1553         if (b43_is_cck_rate(rate))
1554                 ctl |= B43_TXH_PHY_ENC_CCK;
1555         else
1556                 ctl |= B43_TXH_PHY_ENC_OFDM;
1557         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1558
1559         /* Find the position of the TIM and the DTIM_period value
1560          * and write them to SHM. */
1561         ie = bcn->u.beacon.variable;
1562         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563         for (i = 0; i < variable_len - 2; ) {
1564                 uint8_t ie_id, ie_len;
1565
1566                 ie_id = ie[i];
1567                 ie_len = ie[i + 1];
1568                 if (ie_id == 5) {
1569                         u16 tim_position;
1570                         u16 dtim_period;
1571                         /* This is the TIM Information Element */
1572
1573                         /* Check whether the ie_len is in the beacon data range. */
1574                         if (variable_len < ie_len + 2 + i)
1575                                 break;
1576                         /* A valid TIM is at least 4 bytes long. */
1577                         if (ie_len < 4)
1578                                 break;
1579                         tim_found = 1;
1580
1581                         tim_position = sizeof(struct b43_plcp_hdr6);
1582                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1583                         tim_position += i;
1584
1585                         dtim_period = ie[i + 3];
1586
1587                         b43_shm_write16(dev, B43_SHM_SHARED,
1588                                         B43_SHM_SH_TIMBPOS, tim_position);
1589                         b43_shm_write16(dev, B43_SHM_SHARED,
1590                                         B43_SHM_SH_DTIMPER, dtim_period);
1591                         break;
1592                 }
1593                 i += ie_len + 2;
1594         }
1595         if (!tim_found) {
1596                 /*
1597                  * If ucode wants to modify TIM do it behind the beacon, this
1598                  * will happen, for example, when doing mesh networking.
1599                  */
1600                 b43_shm_write16(dev, B43_SHM_SHARED,
1601                                 B43_SHM_SH_TIMBPOS,
1602                                 len + sizeof(struct b43_plcp_hdr6));
1603                 b43_shm_write16(dev, B43_SHM_SHARED,
1604                                 B43_SHM_SH_DTIMPER, 0);
1605         }
1606         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1607 }
1608
1609 static void b43_upload_beacon0(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612
1613         if (wl->beacon0_uploaded)
1614                 return;
1615         b43_write_beacon_template(dev, 0x68, 0x18);
1616         wl->beacon0_uploaded = 1;
1617 }
1618
1619 static void b43_upload_beacon1(struct b43_wldev *dev)
1620 {
1621         struct b43_wl *wl = dev->wl;
1622
1623         if (wl->beacon1_uploaded)
1624                 return;
1625         b43_write_beacon_template(dev, 0x468, 0x1A);
1626         wl->beacon1_uploaded = 1;
1627 }
1628
1629 static void handle_irq_beacon(struct b43_wldev *dev)
1630 {
1631         struct b43_wl *wl = dev->wl;
1632         u32 cmd, beacon0_valid, beacon1_valid;
1633
1634         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1635             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1636                 return;
1637
1638         /* This is the bottom half of the asynchronous beacon update. */
1639
1640         /* Ignore interrupt in the future. */
1641         dev->irq_mask &= ~B43_IRQ_BEACON;
1642
1643         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1644         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1645         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1646
1647         /* Schedule interrupt manually, if busy. */
1648         if (beacon0_valid && beacon1_valid) {
1649                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1650                 dev->irq_mask |= B43_IRQ_BEACON;
1651                 return;
1652         }
1653
1654         if (unlikely(wl->beacon_templates_virgin)) {
1655                 /* We never uploaded a beacon before.
1656                  * Upload both templates now, but only mark one valid. */
1657                 wl->beacon_templates_virgin = 0;
1658                 b43_upload_beacon0(dev);
1659                 b43_upload_beacon1(dev);
1660                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1661                 cmd |= B43_MACCMD_BEACON0_VALID;
1662                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1663         } else {
1664                 if (!beacon0_valid) {
1665                         b43_upload_beacon0(dev);
1666                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1667                         cmd |= B43_MACCMD_BEACON0_VALID;
1668                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1669                 } else if (!beacon1_valid) {
1670                         b43_upload_beacon1(dev);
1671                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1672                         cmd |= B43_MACCMD_BEACON1_VALID;
1673                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1674                 }
1675         }
1676 }
1677
1678 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1679 {
1680         u32 old_irq_mask = dev->irq_mask;
1681
1682         /* update beacon right away or defer to irq */
1683         handle_irq_beacon(dev);
1684         if (old_irq_mask != dev->irq_mask) {
1685                 /* The handler updated the IRQ mask. */
1686                 B43_WARN_ON(!dev->irq_mask);
1687                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1688                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1689                 } else {
1690                         /* Device interrupts are currently disabled. That means
1691                          * we just ran the hardirq handler and scheduled the
1692                          * IRQ thread. The thread will write the IRQ mask when
1693                          * it finished, so there's nothing to do here. Writing
1694                          * the mask _here_ would incorrectly re-enable IRQs. */
1695                 }
1696         }
1697 }
1698
1699 static void b43_beacon_update_trigger_work(struct work_struct *work)
1700 {
1701         struct b43_wl *wl = container_of(work, struct b43_wl,
1702                                          beacon_update_trigger);
1703         struct b43_wldev *dev;
1704
1705         mutex_lock(&wl->mutex);
1706         dev = wl->current_dev;
1707         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1708                 if (b43_bus_host_is_sdio(dev->dev)) {
1709                         /* wl->mutex is enough. */
1710                         b43_do_beacon_update_trigger_work(dev);
1711                         mmiowb();
1712                 } else {
1713                         spin_lock_irq(&wl->hardirq_lock);
1714                         b43_do_beacon_update_trigger_work(dev);
1715                         mmiowb();
1716                         spin_unlock_irq(&wl->hardirq_lock);
1717                 }
1718         }
1719         mutex_unlock(&wl->mutex);
1720 }
1721
1722 /* Asynchronously update the packet templates in template RAM.
1723  * Locking: Requires wl->mutex to be locked. */
1724 static void b43_update_templates(struct b43_wl *wl)
1725 {
1726         struct sk_buff *beacon;
1727
1728         /* This is the top half of the ansynchronous beacon update.
1729          * The bottom half is the beacon IRQ.
1730          * Beacon update must be asynchronous to avoid sending an
1731          * invalid beacon. This can happen for example, if the firmware
1732          * transmits a beacon while we are updating it. */
1733
1734         /* We could modify the existing beacon and set the aid bit in
1735          * the TIM field, but that would probably require resizing and
1736          * moving of data within the beacon template.
1737          * Simply request a new beacon and let mac80211 do the hard work. */
1738         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1739         if (unlikely(!beacon))
1740                 return;
1741
1742         if (wl->current_beacon)
1743                 dev_kfree_skb_any(wl->current_beacon);
1744         wl->current_beacon = beacon;
1745         wl->beacon0_uploaded = 0;
1746         wl->beacon1_uploaded = 0;
1747         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1748 }
1749
1750 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1751 {
1752         b43_time_lock(dev);
1753         if (dev->dev->core_rev >= 3) {
1754                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1755                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1756         } else {
1757                 b43_write16(dev, 0x606, (beacon_int >> 6));
1758                 b43_write16(dev, 0x610, beacon_int);
1759         }
1760         b43_time_unlock(dev);
1761         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1762 }
1763
1764 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1765 {
1766         u16 reason;
1767
1768         /* Read the register that contains the reason code for the panic. */
1769         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1770         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1771
1772         switch (reason) {
1773         default:
1774                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1775                 /* fallthrough */
1776         case B43_FWPANIC_DIE:
1777                 /* Do not restart the controller or firmware.
1778                  * The device is nonfunctional from now on.
1779                  * Restarting would result in this panic to trigger again,
1780                  * so we avoid that recursion. */
1781                 break;
1782         case B43_FWPANIC_RESTART:
1783                 b43_controller_restart(dev, "Microcode panic");
1784                 break;
1785         }
1786 }
1787
1788 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1789 {
1790         unsigned int i, cnt;
1791         u16 reason, marker_id, marker_line;
1792         __le16 *buf;
1793
1794         /* The proprietary firmware doesn't have this IRQ. */
1795         if (!dev->fw.opensource)
1796                 return;
1797
1798         /* Read the register that contains the reason code for this IRQ. */
1799         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1800
1801         switch (reason) {
1802         case B43_DEBUGIRQ_PANIC:
1803                 b43_handle_firmware_panic(dev);
1804                 break;
1805         case B43_DEBUGIRQ_DUMP_SHM:
1806                 if (!B43_DEBUG)
1807                         break; /* Only with driver debugging enabled. */
1808                 buf = kmalloc(4096, GFP_ATOMIC);
1809                 if (!buf) {
1810                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1811                         goto out;
1812                 }
1813                 for (i = 0; i < 4096; i += 2) {
1814                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1815                         buf[i / 2] = cpu_to_le16(tmp);
1816                 }
1817                 b43info(dev->wl, "Shared memory dump:\n");
1818                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1819                                16, 2, buf, 4096, 1);
1820                 kfree(buf);
1821                 break;
1822         case B43_DEBUGIRQ_DUMP_REGS:
1823                 if (!B43_DEBUG)
1824                         break; /* Only with driver debugging enabled. */
1825                 b43info(dev->wl, "Microcode register dump:\n");
1826                 for (i = 0, cnt = 0; i < 64; i++) {
1827                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1828                         if (cnt == 0)
1829                                 printk(KERN_INFO);
1830                         printk("r%02u: 0x%04X  ", i, tmp);
1831                         cnt++;
1832                         if (cnt == 6) {
1833                                 printk("\n");
1834                                 cnt = 0;
1835                         }
1836                 }
1837                 printk("\n");
1838                 break;
1839         case B43_DEBUGIRQ_MARKER:
1840                 if (!B43_DEBUG)
1841                         break; /* Only with driver debugging enabled. */
1842                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1843                                            B43_MARKER_ID_REG);
1844                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1845                                              B43_MARKER_LINE_REG);
1846                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1847                         "at line number %u\n",
1848                         marker_id, marker_line);
1849                 break;
1850         default:
1851                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1852                        reason);
1853         }
1854 out:
1855         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1856         b43_shm_write16(dev, B43_SHM_SCRATCH,
1857                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1858 }
1859
1860 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1861 {
1862         u32 reason;
1863         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1864         u32 merged_dma_reason = 0;
1865         int i;
1866
1867         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1868                 return;
1869
1870         reason = dev->irq_reason;
1871         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1872                 dma_reason[i] = dev->dma_reason[i];
1873                 merged_dma_reason |= dma_reason[i];
1874         }
1875
1876         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1877                 b43err(dev->wl, "MAC transmission error\n");
1878
1879         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1880                 b43err(dev->wl, "PHY transmission error\n");
1881                 rmb();
1882                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1883                         atomic_set(&dev->phy.txerr_cnt,
1884                                    B43_PHY_TX_BADNESS_LIMIT);
1885                         b43err(dev->wl, "Too many PHY TX errors, "
1886                                         "restarting the controller\n");
1887                         b43_controller_restart(dev, "PHY TX errors");
1888                 }
1889         }
1890
1891         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1892                                           B43_DMAIRQ_NONFATALMASK))) {
1893                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1894                         b43err(dev->wl, "Fatal DMA error: "
1895                                "0x%08X, 0x%08X, 0x%08X, "
1896                                "0x%08X, 0x%08X, 0x%08X\n",
1897                                dma_reason[0], dma_reason[1],
1898                                dma_reason[2], dma_reason[3],
1899                                dma_reason[4], dma_reason[5]);
1900                         b43err(dev->wl, "This device does not support DMA "
1901                                "on your system. It will now be switched to PIO.\n");
1902                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1903                         dev->use_pio = 1;
1904                         b43_controller_restart(dev, "DMA error");
1905                         return;
1906                 }
1907                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1908                         b43err(dev->wl, "DMA error: "
1909                                "0x%08X, 0x%08X, 0x%08X, "
1910                                "0x%08X, 0x%08X, 0x%08X\n",
1911                                dma_reason[0], dma_reason[1],
1912                                dma_reason[2], dma_reason[3],
1913                                dma_reason[4], dma_reason[5]);
1914                 }
1915         }
1916
1917         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1918                 handle_irq_ucode_debug(dev);
1919         if (reason & B43_IRQ_TBTT_INDI)
1920                 handle_irq_tbtt_indication(dev);
1921         if (reason & B43_IRQ_ATIM_END)
1922                 handle_irq_atim_end(dev);
1923         if (reason & B43_IRQ_BEACON)
1924                 handle_irq_beacon(dev);
1925         if (reason & B43_IRQ_PMQ)
1926                 handle_irq_pmq(dev);
1927         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1928                 ;/* TODO */
1929         if (reason & B43_IRQ_NOISESAMPLE_OK)
1930                 handle_irq_noise(dev);
1931
1932         /* Check the DMA reason registers for received data. */
1933         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1934                 if (b43_using_pio_transfers(dev))
1935                         b43_pio_rx(dev->pio.rx_queue);
1936                 else
1937                         b43_dma_rx(dev->dma.rx_ring);
1938         }
1939         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1940         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1941         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1942         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1943         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1944
1945         if (reason & B43_IRQ_TX_OK)
1946                 handle_irq_transmit_status(dev);
1947
1948         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1949         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1950
1951 #if B43_DEBUG
1952         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1953                 dev->irq_count++;
1954                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1955                         if (reason & (1 << i))
1956                                 dev->irq_bit_count[i]++;
1957                 }
1958         }
1959 #endif
1960 }
1961
1962 /* Interrupt thread handler. Handles device interrupts in thread context. */
1963 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1964 {
1965         struct b43_wldev *dev = dev_id;
1966
1967         mutex_lock(&dev->wl->mutex);
1968         b43_do_interrupt_thread(dev);
1969         mmiowb();
1970         mutex_unlock(&dev->wl->mutex);
1971
1972         return IRQ_HANDLED;
1973 }
1974
1975 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1976 {
1977         u32 reason;
1978
1979         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1980          * On SDIO, this runs under wl->mutex. */
1981
1982         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1983         if (reason == 0xffffffff)       /* shared IRQ */
1984                 return IRQ_NONE;
1985         reason &= dev->irq_mask;
1986         if (!reason)
1987                 return IRQ_NONE;
1988
1989         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1990             & 0x0001DC00;
1991         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1992             & 0x0000DC00;
1993         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1994             & 0x0000DC00;
1995         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1996             & 0x0001DC00;
1997         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1998             & 0x0000DC00;
1999 /* Unused ring
2000         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2001             & 0x0000DC00;
2002 */
2003
2004         /* ACK the interrupt. */
2005         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2006         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2007         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2008         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2009         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2010         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2011 /* Unused ring
2012         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2013 */
2014
2015         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2016         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2017         /* Save the reason bitmasks for the IRQ thread handler. */
2018         dev->irq_reason = reason;
2019
2020         return IRQ_WAKE_THREAD;
2021 }
2022
2023 /* Interrupt handler top-half. This runs with interrupts disabled. */
2024 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2025 {
2026         struct b43_wldev *dev = dev_id;
2027         irqreturn_t ret;
2028
2029         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2030                 return IRQ_NONE;
2031
2032         spin_lock(&dev->wl->hardirq_lock);
2033         ret = b43_do_interrupt(dev);
2034         mmiowb();
2035         spin_unlock(&dev->wl->hardirq_lock);
2036
2037         return ret;
2038 }
2039
2040 /* SDIO interrupt handler. This runs in process context. */
2041 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2042 {
2043         struct b43_wl *wl = dev->wl;
2044         irqreturn_t ret;
2045
2046         mutex_lock(&wl->mutex);
2047
2048         ret = b43_do_interrupt(dev);
2049         if (ret == IRQ_WAKE_THREAD)
2050                 b43_do_interrupt_thread(dev);
2051
2052         mutex_unlock(&wl->mutex);
2053 }
2054
2055 void b43_do_release_fw(struct b43_firmware_file *fw)
2056 {
2057         release_firmware(fw->data);
2058         fw->data = NULL;
2059         fw->filename = NULL;
2060 }
2061
2062 static void b43_release_firmware(struct b43_wldev *dev)
2063 {
2064         b43_do_release_fw(&dev->fw.ucode);
2065         b43_do_release_fw(&dev->fw.pcm);
2066         b43_do_release_fw(&dev->fw.initvals);
2067         b43_do_release_fw(&dev->fw.initvals_band);
2068 }
2069
2070 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2071 {
2072         const char text[] =
2073                 "You must go to " \
2074                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2075                 "and download the correct firmware for this driver version. " \
2076                 "Please carefully read all instructions on this website.\n";
2077
2078         if (error)
2079                 b43err(wl, text);
2080         else
2081                 b43warn(wl, text);
2082 }
2083
2084 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2085                       const char *name,
2086                       struct b43_firmware_file *fw)
2087 {
2088         const struct firmware *blob;
2089         struct b43_fw_header *hdr;
2090         u32 size;
2091         int err;
2092
2093         if (!name) {
2094                 /* Don't fetch anything. Free possibly cached firmware. */
2095                 /* FIXME: We should probably keep it anyway, to save some headache
2096                  * on suspend/resume with multiband devices. */
2097                 b43_do_release_fw(fw);
2098                 return 0;
2099         }
2100         if (fw->filename) {
2101                 if ((fw->type == ctx->req_type) &&
2102                     (strcmp(fw->filename, name) == 0))
2103                         return 0; /* Already have this fw. */
2104                 /* Free the cached firmware first. */
2105                 /* FIXME: We should probably do this later after we successfully
2106                  * got the new fw. This could reduce headache with multiband devices.
2107                  * We could also redesign this to cache the firmware for all possible
2108                  * bands all the time. */
2109                 b43_do_release_fw(fw);
2110         }
2111
2112         switch (ctx->req_type) {
2113         case B43_FWTYPE_PROPRIETARY:
2114                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2115                          "b43%s/%s.fw",
2116                          modparam_fwpostfix, name);
2117                 break;
2118         case B43_FWTYPE_OPENSOURCE:
2119                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2120                          "b43-open%s/%s.fw",
2121                          modparam_fwpostfix, name);
2122                 break;
2123         default:
2124                 B43_WARN_ON(1);
2125                 return -ENOSYS;
2126         }
2127         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2128         if (err == -ENOENT) {
2129                 snprintf(ctx->errors[ctx->req_type],
2130                          sizeof(ctx->errors[ctx->req_type]),
2131                          "Firmware file \"%s\" not found\n", ctx->fwname);
2132                 return err;
2133         } else if (err) {
2134                 snprintf(ctx->errors[ctx->req_type],
2135                          sizeof(ctx->errors[ctx->req_type]),
2136                          "Firmware file \"%s\" request failed (err=%d)\n",
2137                          ctx->fwname, err);
2138                 return err;
2139         }
2140         if (blob->size < sizeof(struct b43_fw_header))
2141                 goto err_format;
2142         hdr = (struct b43_fw_header *)(blob->data);
2143         switch (hdr->type) {
2144         case B43_FW_TYPE_UCODE:
2145         case B43_FW_TYPE_PCM:
2146                 size = be32_to_cpu(hdr->size);
2147                 if (size != blob->size - sizeof(struct b43_fw_header))
2148                         goto err_format;
2149                 /* fallthrough */
2150         case B43_FW_TYPE_IV:
2151                 if (hdr->ver != 1)
2152                         goto err_format;
2153                 break;
2154         default:
2155                 goto err_format;
2156         }
2157
2158         fw->data = blob;
2159         fw->filename = name;
2160         fw->type = ctx->req_type;
2161
2162         return 0;
2163
2164 err_format:
2165         snprintf(ctx->errors[ctx->req_type],
2166                  sizeof(ctx->errors[ctx->req_type]),
2167                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2168         release_firmware(blob);
2169
2170         return -EPROTO;
2171 }
2172
2173 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2174 {
2175         struct b43_wldev *dev = ctx->dev;
2176         struct b43_firmware *fw = &ctx->dev->fw;
2177         const u8 rev = ctx->dev->dev->core_rev;
2178         const char *filename;
2179         u32 tmshigh;
2180         int err;
2181
2182         /* Files for HT and LCN were found by trying one by one */
2183
2184         /* Get microcode */
2185         if ((rev >= 5) && (rev <= 10)) {
2186                 filename = "ucode5";
2187         } else if ((rev >= 11) && (rev <= 12)) {
2188                 filename = "ucode11";
2189         } else if (rev == 13) {
2190                 filename = "ucode13";
2191         } else if (rev == 14) {
2192                 filename = "ucode14";
2193         } else if (rev == 15) {
2194                 filename = "ucode15";
2195         } else {
2196                 switch (dev->phy.type) {
2197                 case B43_PHYTYPE_N:
2198                         if (rev >= 16)
2199                                 filename = "ucode16_mimo";
2200                         else
2201                                 goto err_no_ucode;
2202                         break;
2203                 case B43_PHYTYPE_HT:
2204                         if (rev == 29)
2205                                 filename = "ucode29_mimo";
2206                         else
2207                                 goto err_no_ucode;
2208                         break;
2209                 case B43_PHYTYPE_LCN:
2210                         if (rev == 24)
2211                                 filename = "ucode24_mimo";
2212                         else
2213                                 goto err_no_ucode;
2214                         break;
2215                 default:
2216                         goto err_no_ucode;
2217                 }
2218         }
2219         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2220         if (err)
2221                 goto err_load;
2222
2223         /* Get PCM code */
2224         if ((rev >= 5) && (rev <= 10))
2225                 filename = "pcm5";
2226         else if (rev >= 11)
2227                 filename = NULL;
2228         else
2229                 goto err_no_pcm;
2230         fw->pcm_request_failed = 0;
2231         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2232         if (err == -ENOENT) {
2233                 /* We did not find a PCM file? Not fatal, but
2234                  * core rev <= 10 must do without hwcrypto then. */
2235                 fw->pcm_request_failed = 1;
2236         } else if (err)
2237                 goto err_load;
2238
2239         /* Get initvals */
2240         switch (dev->phy.type) {
2241         case B43_PHYTYPE_A:
2242                 if ((rev >= 5) && (rev <= 10)) {
2243                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2244                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2245                                 filename = "a0g1initvals5";
2246                         else
2247                                 filename = "a0g0initvals5";
2248                 } else
2249                         goto err_no_initvals;
2250                 break;
2251         case B43_PHYTYPE_G:
2252                 if ((rev >= 5) && (rev <= 10))
2253                         filename = "b0g0initvals5";
2254                 else if (rev >= 13)
2255                         filename = "b0g0initvals13";
2256                 else
2257                         goto err_no_initvals;
2258                 break;
2259         case B43_PHYTYPE_N:
2260                 if (rev >= 16)
2261                         filename = "n0initvals16";
2262                 else if ((rev >= 11) && (rev <= 12))
2263                         filename = "n0initvals11";
2264                 else
2265                         goto err_no_initvals;
2266                 break;
2267         case B43_PHYTYPE_LP:
2268                 if (rev == 13)
2269                         filename = "lp0initvals13";
2270                 else if (rev == 14)
2271                         filename = "lp0initvals14";
2272                 else if (rev >= 15)
2273                         filename = "lp0initvals15";
2274                 else
2275                         goto err_no_initvals;
2276                 break;
2277         case B43_PHYTYPE_HT:
2278                 if (rev == 29)
2279                         filename = "ht0initvals29";
2280                 else
2281                         goto err_no_initvals;
2282                 break;
2283         case B43_PHYTYPE_LCN:
2284                 if (rev == 24)
2285                         filename = "lcn0initvals24";
2286                 else
2287                         goto err_no_initvals;
2288                 break;
2289         default:
2290                 goto err_no_initvals;
2291         }
2292         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2293         if (err)
2294                 goto err_load;
2295
2296         /* Get bandswitch initvals */
2297         switch (dev->phy.type) {
2298         case B43_PHYTYPE_A:
2299                 if ((rev >= 5) && (rev <= 10)) {
2300                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2301                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2302                                 filename = "a0g1bsinitvals5";
2303                         else
2304                                 filename = "a0g0bsinitvals5";
2305                 } else if (rev >= 11)
2306                         filename = NULL;
2307                 else
2308                         goto err_no_initvals;
2309                 break;
2310         case B43_PHYTYPE_G:
2311                 if ((rev >= 5) && (rev <= 10))
2312                         filename = "b0g0bsinitvals5";
2313                 else if (rev >= 11)
2314                         filename = NULL;
2315                 else
2316                         goto err_no_initvals;
2317                 break;
2318         case B43_PHYTYPE_N:
2319                 if (rev >= 16)
2320                         filename = "n0bsinitvals16";
2321                 else if ((rev >= 11) && (rev <= 12))
2322                         filename = "n0bsinitvals11";
2323                 else
2324                         goto err_no_initvals;
2325                 break;
2326         case B43_PHYTYPE_LP:
2327                 if (rev == 13)
2328                         filename = "lp0bsinitvals13";
2329                 else if (rev == 14)
2330                         filename = "lp0bsinitvals14";
2331                 else if (rev >= 15)
2332                         filename = "lp0bsinitvals15";
2333                 else
2334                         goto err_no_initvals;
2335                 break;
2336         case B43_PHYTYPE_HT:
2337                 if (rev == 29)
2338                         filename = "ht0bsinitvals29";
2339                 else
2340                         goto err_no_initvals;
2341                 break;
2342         case B43_PHYTYPE_LCN:
2343                 if (rev == 24)
2344                         filename = "lcn0bsinitvals24";
2345                 else
2346                         goto err_no_initvals;
2347                 break;
2348         default:
2349                 goto err_no_initvals;
2350         }
2351         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2352         if (err)
2353                 goto err_load;
2354
2355         return 0;
2356
2357 err_no_ucode:
2358         err = ctx->fatal_failure = -EOPNOTSUPP;
2359         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2360                "is required for your device (wl-core rev %u)\n", rev);
2361         goto error;
2362
2363 err_no_pcm:
2364         err = ctx->fatal_failure = -EOPNOTSUPP;
2365         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2366                "is required for your device (wl-core rev %u)\n", rev);
2367         goto error;
2368
2369 err_no_initvals:
2370         err = ctx->fatal_failure = -EOPNOTSUPP;
2371         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2372                "is required for your device (wl-core rev %u)\n", rev);
2373         goto error;
2374
2375 err_load:
2376         /* We failed to load this firmware image. The error message
2377          * already is in ctx->errors. Return and let our caller decide
2378          * what to do. */
2379         goto error;
2380
2381 error:
2382         b43_release_firmware(dev);
2383         return err;
2384 }
2385
2386 static int b43_request_firmware(struct b43_wldev *dev)
2387 {
2388         struct b43_request_fw_context *ctx;
2389         unsigned int i;
2390         int err;
2391         const char *errmsg;
2392
2393         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2394         if (!ctx)
2395                 return -ENOMEM;
2396         ctx->dev = dev;
2397
2398         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2399         err = b43_try_request_fw(ctx);
2400         if (!err)
2401                 goto out; /* Successfully loaded it. */
2402         err = ctx->fatal_failure;
2403         if (err)
2404                 goto out;
2405
2406         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2407         err = b43_try_request_fw(ctx);
2408         if (!err)
2409                 goto out; /* Successfully loaded it. */
2410         err = ctx->fatal_failure;
2411         if (err)
2412                 goto out;
2413
2414         /* Could not find a usable firmware. Print the errors. */
2415         for (i = 0; i < B43_NR_FWTYPES; i++) {
2416                 errmsg = ctx->errors[i];
2417                 if (strlen(errmsg))
2418                         b43err(dev->wl, errmsg);
2419         }
2420         b43_print_fw_helptext(dev->wl, 1);
2421         err = -ENOENT;
2422
2423 out:
2424         kfree(ctx);
2425         return err;
2426 }
2427
2428 static int b43_upload_microcode(struct b43_wldev *dev)
2429 {
2430         struct wiphy *wiphy = dev->wl->hw->wiphy;
2431         const size_t hdr_len = sizeof(struct b43_fw_header);
2432         const __be32 *data;
2433         unsigned int i, len;
2434         u16 fwrev, fwpatch, fwdate, fwtime;
2435         u32 tmp, macctl;
2436         int err = 0;
2437
2438         /* Jump the microcode PSM to offset 0 */
2439         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2440         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2441         macctl |= B43_MACCTL_PSM_JMP0;
2442         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2443         /* Zero out all microcode PSM registers and shared memory. */
2444         for (i = 0; i < 64; i++)
2445                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2446         for (i = 0; i < 4096; i += 2)
2447                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2448
2449         /* Upload Microcode. */
2450         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2451         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2452         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2453         for (i = 0; i < len; i++) {
2454                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2455                 udelay(10);
2456         }
2457
2458         if (dev->fw.pcm.data) {
2459                 /* Upload PCM data. */
2460                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2461                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2462                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2463                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2464                 /* No need for autoinc bit in SHM_HW */
2465                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2466                 for (i = 0; i < len; i++) {
2467                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2468                         udelay(10);
2469                 }
2470         }
2471
2472         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2473
2474         /* Start the microcode PSM */
2475         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2476         macctl &= ~B43_MACCTL_PSM_JMP0;
2477         macctl |= B43_MACCTL_PSM_RUN;
2478         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2479
2480         /* Wait for the microcode to load and respond */
2481         i = 0;
2482         while (1) {
2483                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2484                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2485                         break;
2486                 i++;
2487                 if (i >= 20) {
2488                         b43err(dev->wl, "Microcode not responding\n");
2489                         b43_print_fw_helptext(dev->wl, 1);
2490                         err = -ENODEV;
2491                         goto error;
2492                 }
2493                 msleep(50);
2494         }
2495         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2496
2497         /* Get and check the revisions. */
2498         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2499         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2500         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2501         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2502
2503         if (fwrev <= 0x128) {
2504                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2505                        "binary drivers older than version 4.x is unsupported. "
2506                        "You must upgrade your firmware files.\n");
2507                 b43_print_fw_helptext(dev->wl, 1);
2508                 err = -EOPNOTSUPP;
2509                 goto error;
2510         }
2511         dev->fw.rev = fwrev;
2512         dev->fw.patch = fwpatch;
2513         dev->fw.opensource = (fwdate == 0xFFFF);
2514
2515         /* Default to use-all-queues. */
2516         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2517         dev->qos_enabled = !!modparam_qos;
2518         /* Default to firmware/hardware crypto acceleration. */
2519         dev->hwcrypto_enabled = 1;
2520
2521         if (dev->fw.opensource) {
2522                 u16 fwcapa;
2523
2524                 /* Patchlevel info is encoded in the "time" field. */
2525                 dev->fw.patch = fwtime;
2526                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2527                         dev->fw.rev, dev->fw.patch);
2528
2529                 fwcapa = b43_fwcapa_read(dev);
2530                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2531                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2532                         /* Disable hardware crypto and fall back to software crypto. */
2533                         dev->hwcrypto_enabled = 0;
2534                 }
2535                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2536                         b43info(dev->wl, "QoS not supported by firmware\n");
2537                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2538                          * ieee80211_unregister to make sure the networking core can
2539                          * properly free possible resources. */
2540                         dev->wl->hw->queues = 1;
2541                         dev->qos_enabled = 0;
2542                 }
2543         } else {
2544                 b43info(dev->wl, "Loading firmware version %u.%u "
2545                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2546                         fwrev, fwpatch,
2547                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2548                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2549                 if (dev->fw.pcm_request_failed) {
2550                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2551                                 "Hardware accelerated cryptography is disabled.\n");
2552                         b43_print_fw_helptext(dev->wl, 0);
2553                 }
2554         }
2555
2556         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2557                         dev->fw.rev, dev->fw.patch);
2558         wiphy->hw_version = dev->dev->core_id;
2559
2560         if (b43_is_old_txhdr_format(dev)) {
2561                 /* We're over the deadline, but we keep support for old fw
2562                  * until it turns out to be in major conflict with something new. */
2563                 b43warn(dev->wl, "You are using an old firmware image. "
2564                         "Support for old firmware will be removed soon "
2565                         "(official deadline was July 2008).\n");
2566                 b43_print_fw_helptext(dev->wl, 0);
2567         }
2568
2569         return 0;
2570
2571 error:
2572         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2573         macctl &= ~B43_MACCTL_PSM_RUN;
2574         macctl |= B43_MACCTL_PSM_JMP0;
2575         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2576
2577         return err;
2578 }
2579
2580 static int b43_write_initvals(struct b43_wldev *dev,
2581                               const struct b43_iv *ivals,
2582                               size_t count,
2583                               size_t array_size)
2584 {
2585         const struct b43_iv *iv;
2586         u16 offset;
2587         size_t i;
2588         bool bit32;
2589
2590         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2591         iv = ivals;
2592         for (i = 0; i < count; i++) {
2593                 if (array_size < sizeof(iv->offset_size))
2594                         goto err_format;
2595                 array_size -= sizeof(iv->offset_size);
2596                 offset = be16_to_cpu(iv->offset_size);
2597                 bit32 = !!(offset & B43_IV_32BIT);
2598                 offset &= B43_IV_OFFSET_MASK;
2599                 if (offset >= 0x1000)
2600                         goto err_format;
2601                 if (bit32) {
2602                         u32 value;
2603
2604                         if (array_size < sizeof(iv->data.d32))
2605                                 goto err_format;
2606                         array_size -= sizeof(iv->data.d32);
2607
2608                         value = get_unaligned_be32(&iv->data.d32);
2609                         b43_write32(dev, offset, value);
2610
2611                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2612                                                         sizeof(__be16) +
2613                                                         sizeof(__be32));
2614                 } else {
2615                         u16 value;
2616
2617                         if (array_size < sizeof(iv->data.d16))
2618                                 goto err_format;
2619                         array_size -= sizeof(iv->data.d16);
2620
2621                         value = be16_to_cpu(iv->data.d16);
2622                         b43_write16(dev, offset, value);
2623
2624                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2625                                                         sizeof(__be16) +
2626                                                         sizeof(__be16));
2627                 }
2628         }
2629         if (array_size)
2630                 goto err_format;
2631
2632         return 0;
2633
2634 err_format:
2635         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2636         b43_print_fw_helptext(dev->wl, 1);
2637
2638         return -EPROTO;
2639 }
2640
2641 static int b43_upload_initvals(struct b43_wldev *dev)
2642 {
2643         const size_t hdr_len = sizeof(struct b43_fw_header);
2644         const struct b43_fw_header *hdr;
2645         struct b43_firmware *fw = &dev->fw;
2646         const struct b43_iv *ivals;
2647         size_t count;
2648         int err;
2649
2650         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2651         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2652         count = be32_to_cpu(hdr->size);
2653         err = b43_write_initvals(dev, ivals, count,
2654                                  fw->initvals.data->size - hdr_len);
2655         if (err)
2656                 goto out;
2657         if (fw->initvals_band.data) {
2658                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2659                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2660                 count = be32_to_cpu(hdr->size);
2661                 err = b43_write_initvals(dev, ivals, count,
2662                                          fw->initvals_band.data->size - hdr_len);
2663                 if (err)
2664                         goto out;
2665         }
2666 out:
2667
2668         return err;
2669 }
2670
2671 /* Initialize the GPIOs
2672  * http://bcm-specs.sipsolutions.net/GPIO
2673  */
2674 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2675 {
2676         struct ssb_bus *bus = dev->dev->sdev->bus;
2677
2678 #ifdef CONFIG_SSB_DRIVER_PCICORE
2679         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2680 #else
2681         return bus->chipco.dev;
2682 #endif
2683 }
2684
2685 static int b43_gpio_init(struct b43_wldev *dev)
2686 {
2687         struct ssb_device *gpiodev;
2688         u32 mask, set;
2689
2690         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2691                     & ~B43_MACCTL_GPOUTSMSK);
2692
2693         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2694                     | 0x000F);
2695
2696         mask = 0x0000001F;
2697         set = 0x0000000F;
2698         if (dev->dev->chip_id == 0x4301) {
2699                 mask |= 0x0060;
2700                 set |= 0x0060;
2701         }
2702         if (0 /* FIXME: conditional unknown */ ) {
2703                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2704                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2705                             | 0x0100);
2706                 mask |= 0x0180;
2707                 set |= 0x0180;
2708         }
2709         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2710                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2711                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2712                             | 0x0200);
2713                 mask |= 0x0200;
2714                 set |= 0x0200;
2715         }
2716         if (dev->dev->core_rev >= 2)
2717                 mask |= 0x0010; /* FIXME: This is redundant. */
2718
2719         switch (dev->dev->bus_type) {
2720 #ifdef CONFIG_B43_BCMA
2721         case B43_BUS_BCMA:
2722                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2723                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2724                                         BCMA_CC_GPIOCTL) & mask) | set);
2725                 break;
2726 #endif
2727 #ifdef CONFIG_B43_SSB
2728         case B43_BUS_SSB:
2729                 gpiodev = b43_ssb_gpio_dev(dev);
2730                 if (gpiodev)
2731                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2732                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2733                                     & mask) | set);
2734                 break;
2735 #endif
2736         }
2737
2738         return 0;
2739 }
2740
2741 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2742 static void b43_gpio_cleanup(struct b43_wldev *dev)
2743 {
2744         struct ssb_device *gpiodev;
2745
2746         switch (dev->dev->bus_type) {
2747 #ifdef CONFIG_B43_BCMA
2748         case B43_BUS_BCMA:
2749                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2750                                 0);
2751                 break;
2752 #endif
2753 #ifdef CONFIG_B43_SSB
2754         case B43_BUS_SSB:
2755                 gpiodev = b43_ssb_gpio_dev(dev);
2756                 if (gpiodev)
2757                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2758                 break;
2759 #endif
2760         }
2761 }
2762
2763 /* http://bcm-specs.sipsolutions.net/EnableMac */
2764 void b43_mac_enable(struct b43_wldev *dev)
2765 {
2766         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2767                 u16 fwstate;
2768
2769                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2770                                          B43_SHM_SH_UCODESTAT);
2771                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2772                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2773                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2774                                "should be suspended, but current state is %u\n",
2775                                fwstate);
2776                 }
2777         }
2778
2779         dev->mac_suspended--;
2780         B43_WARN_ON(dev->mac_suspended < 0);
2781         if (dev->mac_suspended == 0) {
2782                 b43_write32(dev, B43_MMIO_MACCTL,
2783                             b43_read32(dev, B43_MMIO_MACCTL)
2784                             | B43_MACCTL_ENABLED);
2785                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2786                             B43_IRQ_MAC_SUSPENDED);
2787                 /* Commit writes */
2788                 b43_read32(dev, B43_MMIO_MACCTL);
2789                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2790                 b43_power_saving_ctl_bits(dev, 0);
2791         }
2792 }
2793
2794 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2795 void b43_mac_suspend(struct b43_wldev *dev)
2796 {
2797         int i;
2798         u32 tmp;
2799
2800         might_sleep();
2801         B43_WARN_ON(dev->mac_suspended < 0);
2802
2803         if (dev->mac_suspended == 0) {
2804                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2805                 b43_write32(dev, B43_MMIO_MACCTL,
2806                             b43_read32(dev, B43_MMIO_MACCTL)
2807                             & ~B43_MACCTL_ENABLED);
2808                 /* force pci to flush the write */
2809                 b43_read32(dev, B43_MMIO_MACCTL);
2810                 for (i = 35; i; i--) {
2811                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2812                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2813                                 goto out;
2814                         udelay(10);
2815                 }
2816                 /* Hm, it seems this will take some time. Use msleep(). */
2817                 for (i = 40; i; i--) {
2818                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2819                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2820                                 goto out;
2821                         msleep(1);
2822                 }
2823                 b43err(dev->wl, "MAC suspend failed\n");
2824         }
2825 out:
2826         dev->mac_suspended++;
2827 }
2828
2829 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2830 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2831 {
2832         u32 tmp;
2833
2834         switch (dev->dev->bus_type) {
2835 #ifdef CONFIG_B43_BCMA
2836         case B43_BUS_BCMA:
2837                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2838                 if (on)
2839                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2840                 else
2841                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2842                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2843                 break;
2844 #endif
2845 #ifdef CONFIG_B43_SSB
2846         case B43_BUS_SSB:
2847                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2848                 if (on)
2849                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2850                 else
2851                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2852                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2853                 break;
2854 #endif
2855         }
2856 }
2857
2858 static void b43_adjust_opmode(struct b43_wldev *dev)
2859 {
2860         struct b43_wl *wl = dev->wl;
2861         u32 ctl;
2862         u16 cfp_pretbtt;
2863
2864         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2865         /* Reset status to STA infrastructure mode. */
2866         ctl &= ~B43_MACCTL_AP;
2867         ctl &= ~B43_MACCTL_KEEP_CTL;
2868         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2869         ctl &= ~B43_MACCTL_KEEP_BAD;
2870         ctl &= ~B43_MACCTL_PROMISC;
2871         ctl &= ~B43_MACCTL_BEACPROMISC;
2872         ctl |= B43_MACCTL_INFRA;
2873
2874         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2875             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2876                 ctl |= B43_MACCTL_AP;
2877         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2878                 ctl &= ~B43_MACCTL_INFRA;
2879
2880         if (wl->filter_flags & FIF_CONTROL)
2881                 ctl |= B43_MACCTL_KEEP_CTL;
2882         if (wl->filter_flags & FIF_FCSFAIL)
2883                 ctl |= B43_MACCTL_KEEP_BAD;
2884         if (wl->filter_flags & FIF_PLCPFAIL)
2885                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2886         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2887                 ctl |= B43_MACCTL_PROMISC;
2888         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2889                 ctl |= B43_MACCTL_BEACPROMISC;
2890
2891         /* Workaround: On old hardware the HW-MAC-address-filter
2892          * doesn't work properly, so always run promisc in filter
2893          * it in software. */
2894         if (dev->dev->core_rev <= 4)
2895                 ctl |= B43_MACCTL_PROMISC;
2896
2897         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2898
2899         cfp_pretbtt = 2;
2900         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2901                 if (dev->dev->chip_id == 0x4306 &&
2902                     dev->dev->chip_rev == 3)
2903                         cfp_pretbtt = 100;
2904                 else
2905                         cfp_pretbtt = 50;
2906         }
2907         b43_write16(dev, 0x612, cfp_pretbtt);
2908
2909         /* FIXME: We don't currently implement the PMQ mechanism,
2910          *        so always disable it. If we want to implement PMQ,
2911          *        we need to enable it here (clear DISCPMQ) in AP mode.
2912          */
2913         if (0  /* ctl & B43_MACCTL_AP */) {
2914                 b43_write32(dev, B43_MMIO_MACCTL,
2915                             b43_read32(dev, B43_MMIO_MACCTL)
2916                             & ~B43_MACCTL_DISCPMQ);
2917         } else {
2918                 b43_write32(dev, B43_MMIO_MACCTL,
2919                             b43_read32(dev, B43_MMIO_MACCTL)
2920                             | B43_MACCTL_DISCPMQ);
2921         }
2922 }
2923
2924 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2925 {
2926         u16 offset;
2927
2928         if (is_ofdm) {
2929                 offset = 0x480;
2930                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2931         } else {
2932                 offset = 0x4C0;
2933                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2934         }
2935         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2936                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2937 }
2938
2939 static void b43_rate_memory_init(struct b43_wldev *dev)
2940 {
2941         switch (dev->phy.type) {
2942         case B43_PHYTYPE_A:
2943         case B43_PHYTYPE_G:
2944         case B43_PHYTYPE_N:
2945         case B43_PHYTYPE_LP:
2946                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2947                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2948                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2949                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2950                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2951                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2952                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2953                 if (dev->phy.type == B43_PHYTYPE_A)
2954                         break;
2955                 /* fallthrough */
2956         case B43_PHYTYPE_B:
2957                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2958                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2959                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2960                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2961                 break;
2962         default:
2963                 B43_WARN_ON(1);
2964         }
2965 }
2966
2967 /* Set the default values for the PHY TX Control Words. */
2968 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2969 {
2970         u16 ctl = 0;
2971
2972         ctl |= B43_TXH_PHY_ENC_CCK;
2973         ctl |= B43_TXH_PHY_ANT01AUTO;
2974         ctl |= B43_TXH_PHY_TXPWR;
2975
2976         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2977         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2978         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2979 }
2980
2981 /* Set the TX-Antenna for management frames sent by firmware. */
2982 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2983 {
2984         u16 ant;
2985         u16 tmp;
2986
2987         ant = b43_antenna_to_phyctl(antenna);
2988
2989         /* For ACK/CTS */
2990         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2991         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2992         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2993         /* For Probe Resposes */
2994         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2995         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2996         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2997 }
2998
2999 /* This is the opposite of b43_chip_init() */
3000 static void b43_chip_exit(struct b43_wldev *dev)
3001 {
3002         b43_phy_exit(dev);
3003         b43_gpio_cleanup(dev);
3004         /* firmware is released later */
3005 }
3006
3007 /* Initialize the chip
3008  * http://bcm-specs.sipsolutions.net/ChipInit
3009  */
3010 static int b43_chip_init(struct b43_wldev *dev)
3011 {
3012         struct b43_phy *phy = &dev->phy;
3013         int err;
3014         u32 macctl;
3015         u16 value16;
3016
3017         /* Initialize the MAC control */
3018         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3019         if (dev->phy.gmode)
3020                 macctl |= B43_MACCTL_GMODE;
3021         macctl |= B43_MACCTL_INFRA;
3022         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3023
3024         err = b43_request_firmware(dev);
3025         if (err)
3026                 goto out;
3027         err = b43_upload_microcode(dev);
3028         if (err)
3029                 goto out;       /* firmware is released later */
3030
3031         err = b43_gpio_init(dev);
3032         if (err)
3033                 goto out;       /* firmware is released later */
3034
3035         err = b43_upload_initvals(dev);
3036         if (err)
3037                 goto err_gpio_clean;
3038
3039         /* Turn the Analog on and initialize the PHY. */
3040         phy->ops->switch_analog(dev, 1);
3041         err = b43_phy_init(dev);
3042         if (err)
3043                 goto err_gpio_clean;
3044
3045         /* Disable Interference Mitigation. */
3046         if (phy->ops->interf_mitigation)
3047                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3048
3049         /* Select the antennae */
3050         if (phy->ops->set_rx_antenna)
3051                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3052         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3053
3054         if (phy->type == B43_PHYTYPE_B) {
3055                 value16 = b43_read16(dev, 0x005E);
3056                 value16 |= 0x0004;
3057                 b43_write16(dev, 0x005E, value16);
3058         }
3059         b43_write32(dev, 0x0100, 0x01000000);
3060         if (dev->dev->core_rev < 5)
3061                 b43_write32(dev, 0x010C, 0x01000000);
3062
3063         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3064                     & ~B43_MACCTL_INFRA);
3065         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3066                     | B43_MACCTL_INFRA);
3067
3068         /* Probe Response Timeout value */
3069         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3070         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3071
3072         /* Initially set the wireless operation mode. */
3073         b43_adjust_opmode(dev);
3074
3075         if (dev->dev->core_rev < 3) {
3076                 b43_write16(dev, 0x060E, 0x0000);
3077                 b43_write16(dev, 0x0610, 0x8000);
3078                 b43_write16(dev, 0x0604, 0x0000);
3079                 b43_write16(dev, 0x0606, 0x0200);
3080         } else {
3081                 b43_write32(dev, 0x0188, 0x80000000);
3082                 b43_write32(dev, 0x018C, 0x02000000);
3083         }
3084         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3085         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3086         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3087         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3088         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3089         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3090         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3091
3092         b43_mac_phy_clock_set(dev, true);
3093
3094         switch (dev->dev->bus_type) {
3095 #ifdef CONFIG_B43_BCMA
3096         case B43_BUS_BCMA:
3097                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3098                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3099                 break;
3100 #endif
3101 #ifdef CONFIG_B43_SSB
3102         case B43_BUS_SSB:
3103                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3104                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3105                 break;
3106 #endif
3107         }
3108
3109         err = 0;
3110         b43dbg(dev->wl, "Chip initialized\n");
3111 out:
3112         return err;
3113
3114 err_gpio_clean:
3115         b43_gpio_cleanup(dev);
3116         return err;
3117 }
3118
3119 static void b43_periodic_every60sec(struct b43_wldev *dev)
3120 {
3121         const struct b43_phy_operations *ops = dev->phy.ops;
3122
3123         if (ops->pwork_60sec)
3124                 ops->pwork_60sec(dev);
3125
3126         /* Force check the TX power emission now. */
3127         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3128 }
3129
3130 static void b43_periodic_every30sec(struct b43_wldev *dev)
3131 {
3132         /* Update device statistics. */
3133         b43_calculate_link_quality(dev);
3134 }
3135
3136 static void b43_periodic_every15sec(struct b43_wldev *dev)
3137 {
3138         struct b43_phy *phy = &dev->phy;
3139         u16 wdr;
3140
3141         if (dev->fw.opensource) {
3142                 /* Check if the firmware is still alive.
3143                  * It will reset the watchdog counter to 0 in its idle loop. */
3144                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3145                 if (unlikely(wdr)) {
3146                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3147                         b43_controller_restart(dev, "Firmware watchdog");
3148                         return;
3149                 } else {
3150                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3151                                         B43_WATCHDOG_REG, 1);
3152                 }
3153         }
3154
3155         if (phy->ops->pwork_15sec)
3156                 phy->ops->pwork_15sec(dev);
3157
3158         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3159         wmb();
3160
3161 #if B43_DEBUG
3162         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3163                 unsigned int i;
3164
3165                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3166                        dev->irq_count / 15,
3167                        dev->tx_count / 15,
3168                        dev->rx_count / 15);
3169                 dev->irq_count = 0;
3170                 dev->tx_count = 0;
3171                 dev->rx_count = 0;
3172                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3173                         if (dev->irq_bit_count[i]) {
3174                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3175                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3176                                 dev->irq_bit_count[i] = 0;
3177                         }
3178                 }
3179         }
3180 #endif
3181 }
3182
3183 static void do_periodic_work(struct b43_wldev *dev)
3184 {
3185         unsigned int state;
3186
3187         state = dev->periodic_state;
3188         if (state % 4 == 0)
3189                 b43_periodic_every60sec(dev);
3190         if (state % 2 == 0)
3191                 b43_periodic_every30sec(dev);
3192         b43_periodic_every15sec(dev);
3193 }
3194
3195 /* Periodic work locking policy:
3196  *      The whole periodic work handler is protected by
3197  *      wl->mutex. If another lock is needed somewhere in the
3198  *      pwork callchain, it's acquired in-place, where it's needed.
3199  */
3200 static void b43_periodic_work_handler(struct work_struct *work)
3201 {
3202         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3203                                              periodic_work.work);
3204         struct b43_wl *wl = dev->wl;
3205         unsigned long delay;
3206
3207         mutex_lock(&wl->mutex);
3208
3209         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3210                 goto out;
3211         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3212                 goto out_requeue;
3213
3214         do_periodic_work(dev);
3215
3216         dev->periodic_state++;
3217 out_requeue:
3218         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3219                 delay = msecs_to_jiffies(50);
3220         else
3221                 delay = round_jiffies_relative(HZ * 15);
3222         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3223 out:
3224         mutex_unlock(&wl->mutex);
3225 }
3226
3227 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3228 {
3229         struct delayed_work *work = &dev->periodic_work;
3230
3231         dev->periodic_state = 0;
3232         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3233         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3234 }
3235
3236 /* Check if communication with the device works correctly. */
3237 static int b43_validate_chipaccess(struct b43_wldev *dev)
3238 {
3239         u32 v, backup0, backup4;
3240
3241         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3242         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3243
3244         /* Check for read/write and endianness problems. */
3245         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3246         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3247                 goto error;
3248         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3249         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3250                 goto error;
3251
3252         /* Check if unaligned 32bit SHM_SHARED access works properly.
3253          * However, don't bail out on failure, because it's noncritical. */
3254         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3255         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3256         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3257         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3258         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3259                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3260         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3261         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3262             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3263             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3264             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3265                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3266
3267         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3268         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3269
3270         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3271                 /* The 32bit register shadows the two 16bit registers
3272                  * with update sideeffects. Validate this. */
3273                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3274                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3275                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3276                         goto error;
3277                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3278                         goto error;
3279         }
3280         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3281
3282         v = b43_read32(dev, B43_MMIO_MACCTL);
3283         v |= B43_MACCTL_GMODE;
3284         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3285                 goto error;
3286
3287         return 0;
3288 error:
3289         b43err(dev->wl, "Failed to validate the chipaccess\n");
3290         return -ENODEV;
3291 }
3292
3293 static void b43_security_init(struct b43_wldev *dev)
3294 {
3295         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3296         /* KTP is a word address, but we address SHM bytewise.
3297          * So multiply by two.
3298          */
3299         dev->ktp *= 2;
3300         /* Number of RCMTA address slots */
3301         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3302         /* Clear the key memory. */
3303         b43_clear_keys(dev);
3304 }
3305
3306 #ifdef CONFIG_B43_HWRNG
3307 static int b43_rng_read(struct hwrng *rng, u32 *data)
3308 {
3309         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3310         struct b43_wldev *dev;
3311         int count = -ENODEV;
3312
3313         mutex_lock(&wl->mutex);
3314         dev = wl->current_dev;
3315         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3316                 *data = b43_read16(dev, B43_MMIO_RNG);
3317                 count = sizeof(u16);
3318         }
3319         mutex_unlock(&wl->mutex);
3320
3321         return count;
3322 }
3323 #endif /* CONFIG_B43_HWRNG */
3324
3325 static void b43_rng_exit(struct b43_wl *wl)
3326 {
3327 #ifdef CONFIG_B43_HWRNG
3328         if (wl->rng_initialized)
3329                 hwrng_unregister(&wl->rng);
3330 #endif /* CONFIG_B43_HWRNG */
3331 }
3332
3333 static int b43_rng_init(struct b43_wl *wl)
3334 {
3335         int err = 0;
3336
3337 #ifdef CONFIG_B43_HWRNG
3338         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3339                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3340         wl->rng.name = wl->rng_name;
3341         wl->rng.data_read = b43_rng_read;
3342         wl->rng.priv = (unsigned long)wl;
3343         wl->rng_initialized = 1;
3344         err = hwrng_register(&wl->rng);
3345         if (err) {
3346                 wl->rng_initialized = 0;
3347                 b43err(wl, "Failed to register the random "
3348                        "number generator (%d)\n", err);
3349         }
3350 #endif /* CONFIG_B43_HWRNG */
3351
3352         return err;
3353 }
3354
3355 static void b43_tx_work(struct work_struct *work)
3356 {
3357         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3358         struct b43_wldev *dev;
3359         struct sk_buff *skb;
3360         int err = 0;
3361
3362         mutex_lock(&wl->mutex);
3363         dev = wl->current_dev;
3364         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3365                 mutex_unlock(&wl->mutex);
3366                 return;
3367         }
3368
3369         while (skb_queue_len(&wl->tx_queue)) {
3370                 skb = skb_dequeue(&wl->tx_queue);
3371
3372                 if (b43_using_pio_transfers(dev))
3373                         err = b43_pio_tx(dev, skb);
3374                 else
3375                         err = b43_dma_tx(dev, skb);
3376                 if (unlikely(err))
3377                         dev_kfree_skb(skb); /* Drop it */
3378         }
3379
3380 #if B43_DEBUG
3381         dev->tx_count++;
3382 #endif
3383         mutex_unlock(&wl->mutex);
3384 }
3385
3386 static void b43_op_tx(struct ieee80211_hw *hw,
3387                      struct sk_buff *skb)
3388 {
3389         struct b43_wl *wl = hw_to_b43_wl(hw);
3390
3391         if (unlikely(skb->len < 2 + 2 + 6)) {
3392                 /* Too short, this can't be a valid frame. */
3393                 dev_kfree_skb_any(skb);
3394                 return;
3395         }
3396         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3397
3398         skb_queue_tail(&wl->tx_queue, skb);
3399         ieee80211_queue_work(wl->hw, &wl->tx_work);
3400 }
3401
3402 static void b43_qos_params_upload(struct b43_wldev *dev,
3403                                   const struct ieee80211_tx_queue_params *p,
3404                                   u16 shm_offset)
3405 {
3406         u16 params[B43_NR_QOSPARAMS];
3407         int bslots, tmp;
3408         unsigned int i;
3409
3410         if (!dev->qos_enabled)
3411                 return;
3412
3413         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3414
3415         memset(&params, 0, sizeof(params));
3416
3417         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3418         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3419         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3420         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3421         params[B43_QOSPARAM_AIFS] = p->aifs;
3422         params[B43_QOSPARAM_BSLOTS] = bslots;
3423         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3424
3425         for (i = 0; i < ARRAY_SIZE(params); i++) {
3426                 if (i == B43_QOSPARAM_STATUS) {
3427                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3428                                              shm_offset + (i * 2));
3429                         /* Mark the parameters as updated. */
3430                         tmp |= 0x100;
3431                         b43_shm_write16(dev, B43_SHM_SHARED,
3432                                         shm_offset + (i * 2),
3433                                         tmp);
3434                 } else {
3435                         b43_shm_write16(dev, B43_SHM_SHARED,
3436                                         shm_offset + (i * 2),
3437                                         params[i]);
3438                 }
3439         }
3440 }
3441
3442 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3443 static const u16 b43_qos_shm_offsets[] = {
3444         /* [mac80211-queue-nr] = SHM_OFFSET, */
3445         [0] = B43_QOS_VOICE,
3446         [1] = B43_QOS_VIDEO,
3447         [2] = B43_QOS_BESTEFFORT,
3448         [3] = B43_QOS_BACKGROUND,
3449 };
3450
3451 /* Update all QOS parameters in hardware. */
3452 static void b43_qos_upload_all(struct b43_wldev *dev)
3453 {
3454         struct b43_wl *wl = dev->wl;
3455         struct b43_qos_params *params;
3456         unsigned int i;
3457
3458         if (!dev->qos_enabled)
3459                 return;
3460
3461         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3462                      ARRAY_SIZE(wl->qos_params));
3463
3464         b43_mac_suspend(dev);
3465         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3466                 params = &(wl->qos_params[i]);
3467                 b43_qos_params_upload(dev, &(params->p),
3468                                       b43_qos_shm_offsets[i]);
3469         }
3470         b43_mac_enable(dev);
3471 }
3472
3473 static void b43_qos_clear(struct b43_wl *wl)
3474 {
3475         struct b43_qos_params *params;
3476         unsigned int i;
3477
3478         /* Initialize QoS parameters to sane defaults. */
3479
3480         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3481                      ARRAY_SIZE(wl->qos_params));
3482
3483         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3484                 params = &(wl->qos_params[i]);
3485
3486                 switch (b43_qos_shm_offsets[i]) {
3487                 case B43_QOS_VOICE:
3488                         params->p.txop = 0;
3489                         params->p.aifs = 2;
3490                         params->p.cw_min = 0x0001;
3491                         params->p.cw_max = 0x0001;
3492                         break;
3493                 case B43_QOS_VIDEO:
3494                         params->p.txop = 0;
3495                         params->p.aifs = 2;
3496                         params->p.cw_min = 0x0001;
3497                         params->p.cw_max = 0x0001;
3498                         break;
3499                 case B43_QOS_BESTEFFORT:
3500                         params->p.txop = 0;
3501                         params->p.aifs = 3;
3502                         params->p.cw_min = 0x0001;
3503                         params->p.cw_max = 0x03FF;
3504                         break;
3505                 case B43_QOS_BACKGROUND:
3506                         params->p.txop = 0;
3507                         params->p.aifs = 7;
3508                         params->p.cw_min = 0x0001;
3509                         params->p.cw_max = 0x03FF;
3510                         break;
3511                 default:
3512                         B43_WARN_ON(1);
3513                 }
3514         }
3515 }
3516
3517 /* Initialize the core's QOS capabilities */
3518 static void b43_qos_init(struct b43_wldev *dev)
3519 {
3520         if (!dev->qos_enabled) {
3521                 /* Disable QOS support. */
3522                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3523                 b43_write16(dev, B43_MMIO_IFSCTL,
3524                             b43_read16(dev, B43_MMIO_IFSCTL)
3525                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3526                 b43dbg(dev->wl, "QoS disabled\n");
3527                 return;
3528         }
3529
3530         /* Upload the current QOS parameters. */
3531         b43_qos_upload_all(dev);
3532
3533         /* Enable QOS support. */
3534         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3535         b43_write16(dev, B43_MMIO_IFSCTL,
3536                     b43_read16(dev, B43_MMIO_IFSCTL)
3537                     | B43_MMIO_IFSCTL_USE_EDCF);
3538         b43dbg(dev->wl, "QoS enabled\n");
3539 }
3540
3541 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3542                           const struct ieee80211_tx_queue_params *params)
3543 {
3544         struct b43_wl *wl = hw_to_b43_wl(hw);
3545         struct b43_wldev *dev;
3546         unsigned int queue = (unsigned int)_queue;
3547         int err = -ENODEV;
3548
3549         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3550                 /* Queue not available or don't support setting
3551                  * params on this queue. Return success to not
3552                  * confuse mac80211. */
3553                 return 0;
3554         }
3555         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3556                      ARRAY_SIZE(wl->qos_params));
3557
3558         mutex_lock(&wl->mutex);
3559         dev = wl->current_dev;
3560         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3561                 goto out_unlock;
3562
3563         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3564         b43_mac_suspend(dev);
3565         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3566                               b43_qos_shm_offsets[queue]);
3567         b43_mac_enable(dev);
3568         err = 0;
3569
3570 out_unlock:
3571         mutex_unlock(&wl->mutex);
3572
3573         return err;
3574 }
3575
3576 static int b43_op_get_stats(struct ieee80211_hw *hw,
3577                             struct ieee80211_low_level_stats *stats)
3578 {
3579         struct b43_wl *wl = hw_to_b43_wl(hw);
3580
3581         mutex_lock(&wl->mutex);
3582         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3583         mutex_unlock(&wl->mutex);
3584
3585         return 0;
3586 }
3587
3588 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3589 {
3590         struct b43_wl *wl = hw_to_b43_wl(hw);
3591         struct b43_wldev *dev;
3592         u64 tsf;
3593
3594         mutex_lock(&wl->mutex);
3595         dev = wl->current_dev;
3596
3597         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3598                 b43_tsf_read(dev, &tsf);
3599         else
3600                 tsf = 0;
3601
3602         mutex_unlock(&wl->mutex);
3603
3604         return tsf;
3605 }
3606
3607 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3608 {
3609         struct b43_wl *wl = hw_to_b43_wl(hw);
3610         struct b43_wldev *dev;
3611
3612         mutex_lock(&wl->mutex);
3613         dev = wl->current_dev;
3614
3615         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3616                 b43_tsf_write(dev, tsf);
3617
3618         mutex_unlock(&wl->mutex);
3619 }
3620
3621 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3622 {
3623         u32 tmp;
3624
3625         switch (dev->dev->bus_type) {
3626 #ifdef CONFIG_B43_BCMA
3627         case B43_BUS_BCMA:
3628                 b43err(dev->wl,
3629                        "Putting PHY into reset not supported on BCMA\n");
3630                 break;
3631 #endif
3632 #ifdef CONFIG_B43_SSB
3633         case B43_BUS_SSB:
3634                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3635                 tmp &= ~B43_TMSLOW_GMODE;
3636                 tmp |= B43_TMSLOW_PHYRESET;
3637                 tmp |= SSB_TMSLOW_FGC;
3638                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3639                 msleep(1);
3640
3641                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3642                 tmp &= ~SSB_TMSLOW_FGC;
3643                 tmp |= B43_TMSLOW_PHYRESET;
3644                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3645                 msleep(1);
3646
3647                 break;
3648 #endif
3649         }
3650 }
3651
3652 static const char *band_to_string(enum ieee80211_band band)
3653 {
3654         switch (band) {
3655         case IEEE80211_BAND_5GHZ:
3656                 return "5";
3657         case IEEE80211_BAND_2GHZ:
3658                 return "2.4";
3659         default:
3660                 break;
3661         }
3662         B43_WARN_ON(1);
3663         return "";
3664 }
3665
3666 /* Expects wl->mutex locked */
3667 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3668 {
3669         struct b43_wldev *up_dev = NULL;
3670         struct b43_wldev *down_dev;
3671         struct b43_wldev *d;
3672         int err;
3673         bool uninitialized_var(gmode);
3674         int prev_status;
3675
3676         /* Find a device and PHY which supports the band. */
3677         list_for_each_entry(d, &wl->devlist, list) {
3678                 switch (chan->band) {
3679                 case IEEE80211_BAND_5GHZ:
3680                         if (d->phy.supports_5ghz) {
3681                                 up_dev = d;
3682                                 gmode = 0;
3683                         }
3684                         break;
3685                 case IEEE80211_BAND_2GHZ:
3686                         if (d->phy.supports_2ghz) {
3687                                 up_dev = d;
3688                                 gmode = 1;
3689                         }
3690                         break;
3691                 default:
3692                         B43_WARN_ON(1);
3693                         return -EINVAL;
3694                 }
3695                 if (up_dev)
3696                         break;
3697         }
3698         if (!up_dev) {
3699                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3700                        band_to_string(chan->band));
3701                 return -ENODEV;
3702         }
3703         if ((up_dev == wl->current_dev) &&
3704             (!!wl->current_dev->phy.gmode == !!gmode)) {
3705                 /* This device is already running. */
3706                 return 0;
3707         }
3708         b43dbg(wl, "Switching to %s-GHz band\n",
3709                band_to_string(chan->band));
3710         down_dev = wl->current_dev;
3711
3712         prev_status = b43_status(down_dev);
3713         /* Shutdown the currently running core. */
3714         if (prev_status >= B43_STAT_STARTED)
3715                 down_dev = b43_wireless_core_stop(down_dev);
3716         if (prev_status >= B43_STAT_INITIALIZED)
3717                 b43_wireless_core_exit(down_dev);
3718
3719         if (down_dev != up_dev) {
3720                 /* We switch to a different core, so we put PHY into
3721                  * RESET on the old core. */
3722                 b43_put_phy_into_reset(down_dev);
3723         }
3724
3725         /* Now start the new core. */
3726         up_dev->phy.gmode = gmode;
3727         if (prev_status >= B43_STAT_INITIALIZED) {
3728                 err = b43_wireless_core_init(up_dev);
3729                 if (err) {
3730                         b43err(wl, "Fatal: Could not initialize device for "
3731                                "selected %s-GHz band\n",
3732                                band_to_string(chan->band));
3733                         goto init_failure;
3734                 }
3735         }
3736         if (prev_status >= B43_STAT_STARTED) {
3737                 err = b43_wireless_core_start(up_dev);
3738                 if (err) {
3739                         b43err(wl, "Fatal: Coult not start device for "
3740                                "selected %s-GHz band\n",
3741                                band_to_string(chan->band));
3742                         b43_wireless_core_exit(up_dev);
3743                         goto init_failure;
3744                 }
3745         }
3746         B43_WARN_ON(b43_status(up_dev) != prev_status);
3747
3748         wl->current_dev = up_dev;
3749
3750         return 0;
3751 init_failure:
3752         /* Whoops, failed to init the new core. No core is operating now. */
3753         wl->current_dev = NULL;
3754         return err;
3755 }
3756
3757 /* Write the short and long frame retry limit values. */
3758 static void b43_set_retry_limits(struct b43_wldev *dev,
3759                                  unsigned int short_retry,
3760                                  unsigned int long_retry)
3761 {
3762         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3763          * the chip-internal counter. */
3764         short_retry = min(short_retry, (unsigned int)0xF);
3765         long_retry = min(long_retry, (unsigned int)0xF);
3766
3767         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3768                         short_retry);
3769         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3770                         long_retry);
3771 }
3772
3773 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3774 {
3775         struct b43_wl *wl = hw_to_b43_wl(hw);
3776         struct b43_wldev *dev;
3777         struct b43_phy *phy;
3778         struct ieee80211_conf *conf = &hw->conf;
3779         int antenna;
3780         int err = 0;
3781
3782         mutex_lock(&wl->mutex);
3783
3784         /* Switch the band (if necessary). This might change the active core. */
3785         err = b43_switch_band(wl, conf->channel);
3786         if (err)
3787                 goto out_unlock_mutex;
3788         dev = wl->current_dev;
3789         phy = &dev->phy;
3790
3791         if (conf_is_ht(conf))
3792                 phy->is_40mhz =
3793                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3794         else
3795                 phy->is_40mhz = false;
3796
3797         b43_mac_suspend(dev);
3798
3799         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3800                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3801                                           conf->long_frame_max_tx_count);
3802         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3803         if (!changed)
3804                 goto out_mac_enable;
3805
3806         /* Switch to the requested channel.
3807          * The firmware takes care of races with the TX handler. */
3808         if (conf->channel->hw_value != phy->channel)
3809                 b43_switch_channel(dev, conf->channel->hw_value);
3810
3811         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3812
3813         /* Adjust the desired TX power level. */
3814         if (conf->power_level != 0) {
3815                 if (conf->power_level != phy->desired_txpower) {
3816                         phy->desired_txpower = conf->power_level;
3817                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3818                                                    B43_TXPWR_IGNORE_TSSI);
3819                 }
3820         }
3821
3822         /* Antennas for RX and management frame TX. */
3823         antenna = B43_ANTENNA_DEFAULT;
3824         b43_mgmtframe_txantenna(dev, antenna);
3825         antenna = B43_ANTENNA_DEFAULT;
3826         if (phy->ops->set_rx_antenna)
3827                 phy->ops->set_rx_antenna(dev, antenna);
3828
3829         if (wl->radio_enabled != phy->radio_on) {
3830                 if (wl->radio_enabled) {
3831                         b43_software_rfkill(dev, false);
3832                         b43info(dev->wl, "Radio turned on by software\n");
3833                         if (!dev->radio_hw_enable) {
3834                                 b43info(dev->wl, "The hardware RF-kill button "
3835                                         "still turns the radio physically off. "
3836                                         "Press the button to turn it on.\n");
3837                         }
3838                 } else {
3839                         b43_software_rfkill(dev, true);
3840                         b43info(dev->wl, "Radio turned off by software\n");
3841                 }
3842         }
3843
3844 out_mac_enable:
3845         b43_mac_enable(dev);
3846 out_unlock_mutex:
3847         mutex_unlock(&wl->mutex);
3848
3849         return err;
3850 }
3851
3852 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3853 {
3854         struct ieee80211_supported_band *sband =
3855                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3856         struct ieee80211_rate *rate;
3857         int i;
3858         u16 basic, direct, offset, basic_offset, rateptr;
3859
3860         for (i = 0; i < sband->n_bitrates; i++) {
3861                 rate = &sband->bitrates[i];
3862
3863                 if (b43_is_cck_rate(rate->hw_value)) {
3864                         direct = B43_SHM_SH_CCKDIRECT;
3865                         basic = B43_SHM_SH_CCKBASIC;
3866                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3867                         offset &= 0xF;
3868                 } else {
3869                         direct = B43_SHM_SH_OFDMDIRECT;
3870                         basic = B43_SHM_SH_OFDMBASIC;
3871                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3872                         offset &= 0xF;
3873                 }
3874
3875                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3876
3877                 if (b43_is_cck_rate(rate->hw_value)) {
3878                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3879                         basic_offset &= 0xF;
3880                 } else {
3881                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3882                         basic_offset &= 0xF;
3883                 }
3884
3885                 /*
3886                  * Get the pointer that we need to point to
3887                  * from the direct map
3888                  */
3889                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3890                                          direct + 2 * basic_offset);
3891                 /* and write it to the basic map */
3892                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3893                                 rateptr);
3894         }
3895 }
3896
3897 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3898                                     struct ieee80211_vif *vif,
3899                                     struct ieee80211_bss_conf *conf,
3900                                     u32 changed)
3901 {
3902         struct b43_wl *wl = hw_to_b43_wl(hw);
3903         struct b43_wldev *dev;
3904
3905         mutex_lock(&wl->mutex);
3906
3907         dev = wl->current_dev;
3908         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3909                 goto out_unlock_mutex;
3910
3911         B43_WARN_ON(wl->vif != vif);
3912
3913         if (changed & BSS_CHANGED_BSSID) {
3914                 if (conf->bssid)
3915                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3916                 else
3917                         memset(wl->bssid, 0, ETH_ALEN);
3918         }
3919
3920         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3921                 if (changed & BSS_CHANGED_BEACON &&
3922                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3923                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3924                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3925                         b43_update_templates(wl);
3926
3927                 if (changed & BSS_CHANGED_BSSID)
3928                         b43_write_mac_bssid_templates(dev);
3929         }
3930
3931         b43_mac_suspend(dev);
3932
3933         /* Update templates for AP/mesh mode. */
3934         if (changed & BSS_CHANGED_BEACON_INT &&
3935             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3936              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3937              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3938                 b43_set_beacon_int(dev, conf->beacon_int);
3939
3940         if (changed & BSS_CHANGED_BASIC_RATES)
3941                 b43_update_basic_rates(dev, conf->basic_rates);
3942
3943         if (changed & BSS_CHANGED_ERP_SLOT) {
3944                 if (conf->use_short_slot)
3945                         b43_short_slot_timing_enable(dev);
3946                 else
3947                         b43_short_slot_timing_disable(dev);
3948         }
3949
3950         b43_mac_enable(dev);
3951 out_unlock_mutex:
3952         mutex_unlock(&wl->mutex);
3953 }
3954
3955 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3956                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3957                           struct ieee80211_key_conf *key)
3958 {
3959         struct b43_wl *wl = hw_to_b43_wl(hw);
3960         struct b43_wldev *dev;
3961         u8 algorithm;
3962         u8 index;
3963         int err;
3964         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3965
3966         if (modparam_nohwcrypt)
3967                 return -ENOSPC; /* User disabled HW-crypto */
3968
3969         mutex_lock(&wl->mutex);
3970
3971         dev = wl->current_dev;
3972         err = -ENODEV;
3973         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3974                 goto out_unlock;
3975
3976         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3977                 /* We don't have firmware for the crypto engine.
3978                  * Must use software-crypto. */
3979                 err = -EOPNOTSUPP;
3980                 goto out_unlock;
3981         }
3982
3983         err = -EINVAL;
3984         switch (key->cipher) {
3985         case WLAN_CIPHER_SUITE_WEP40:
3986                 algorithm = B43_SEC_ALGO_WEP40;
3987                 break;
3988         case WLAN_CIPHER_SUITE_WEP104:
3989                 algorithm = B43_SEC_ALGO_WEP104;
3990                 break;
3991         case WLAN_CIPHER_SUITE_TKIP:
3992                 algorithm = B43_SEC_ALGO_TKIP;
3993                 break;
3994         case WLAN_CIPHER_SUITE_CCMP:
3995                 algorithm = B43_SEC_ALGO_AES;
3996                 break;
3997         default:
3998                 B43_WARN_ON(1);
3999                 goto out_unlock;
4000         }
4001         index = (u8) (key->keyidx);
4002         if (index > 3)
4003                 goto out_unlock;
4004
4005         switch (cmd) {
4006         case SET_KEY:
4007                 if (algorithm == B43_SEC_ALGO_TKIP &&
4008                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4009                     !modparam_hwtkip)) {
4010                         /* We support only pairwise key */
4011                         err = -EOPNOTSUPP;
4012                         goto out_unlock;
4013                 }
4014
4015                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4016                         if (WARN_ON(!sta)) {
4017                                 err = -EOPNOTSUPP;
4018                                 goto out_unlock;
4019                         }
4020                         /* Pairwise key with an assigned MAC address. */
4021                         err = b43_key_write(dev, -1, algorithm,
4022                                             key->key, key->keylen,
4023                                             sta->addr, key);
4024                 } else {
4025                         /* Group key */
4026                         err = b43_key_write(dev, index, algorithm,
4027                                             key->key, key->keylen, NULL, key);
4028                 }
4029                 if (err)
4030                         goto out_unlock;
4031
4032                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4033                     algorithm == B43_SEC_ALGO_WEP104) {
4034                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4035                 } else {
4036                         b43_hf_write(dev,
4037                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4038                 }
4039                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4040                 if (algorithm == B43_SEC_ALGO_TKIP)
4041                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4042                 break;
4043         case DISABLE_KEY: {
4044                 err = b43_key_clear(dev, key->hw_key_idx);
4045                 if (err)
4046                         goto out_unlock;
4047                 break;
4048         }
4049         default:
4050                 B43_WARN_ON(1);
4051         }
4052
4053 out_unlock:
4054         if (!err) {
4055                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4056                        "mac: %pM\n",
4057                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4058                        sta ? sta->addr : bcast_addr);
4059                 b43_dump_keymemory(dev);
4060         }
4061         mutex_unlock(&wl->mutex);
4062
4063         return err;
4064 }
4065
4066 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4067                                     unsigned int changed, unsigned int *fflags,
4068                                     u64 multicast)
4069 {
4070         struct b43_wl *wl = hw_to_b43_wl(hw);
4071         struct b43_wldev *dev;
4072
4073         mutex_lock(&wl->mutex);
4074         dev = wl->current_dev;
4075         if (!dev) {
4076                 *fflags = 0;
4077                 goto out_unlock;
4078         }
4079
4080         *fflags &= FIF_PROMISC_IN_BSS |
4081                   FIF_ALLMULTI |
4082                   FIF_FCSFAIL |
4083                   FIF_PLCPFAIL |
4084                   FIF_CONTROL |
4085                   FIF_OTHER_BSS |
4086                   FIF_BCN_PRBRESP_PROMISC;
4087
4088         changed &= FIF_PROMISC_IN_BSS |
4089                    FIF_ALLMULTI |
4090                    FIF_FCSFAIL |
4091                    FIF_PLCPFAIL |
4092                    FIF_CONTROL |
4093                    FIF_OTHER_BSS |
4094                    FIF_BCN_PRBRESP_PROMISC;
4095
4096         wl->filter_flags = *fflags;
4097
4098         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4099                 b43_adjust_opmode(dev);
4100
4101 out_unlock:
4102         mutex_unlock(&wl->mutex);
4103 }
4104
4105 /* Locking: wl->mutex
4106  * Returns the current dev. This might be different from the passed in dev,
4107  * because the core might be gone away while we unlocked the mutex. */
4108 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4109 {
4110         struct b43_wl *wl = dev->wl;
4111         struct b43_wldev *orig_dev;
4112         u32 mask;
4113
4114 redo:
4115         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4116                 return dev;
4117
4118         /* Cancel work. Unlock to avoid deadlocks. */
4119         mutex_unlock(&wl->mutex);
4120         cancel_delayed_work_sync(&dev->periodic_work);
4121         cancel_work_sync(&wl->tx_work);
4122         mutex_lock(&wl->mutex);
4123         dev = wl->current_dev;
4124         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4125                 /* Whoops, aliens ate up the device while we were unlocked. */
4126                 return dev;
4127         }
4128
4129         /* Disable interrupts on the device. */
4130         b43_set_status(dev, B43_STAT_INITIALIZED);
4131         if (b43_bus_host_is_sdio(dev->dev)) {
4132                 /* wl->mutex is locked. That is enough. */
4133                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4134                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4135         } else {
4136                 spin_lock_irq(&wl->hardirq_lock);
4137                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4138                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4139                 spin_unlock_irq(&wl->hardirq_lock);
4140         }
4141         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4142         orig_dev = dev;
4143         mutex_unlock(&wl->mutex);
4144         if (b43_bus_host_is_sdio(dev->dev)) {
4145                 b43_sdio_free_irq(dev);
4146         } else {
4147                 synchronize_irq(dev->dev->irq);
4148                 free_irq(dev->dev->irq, dev);
4149         }
4150         mutex_lock(&wl->mutex);
4151         dev = wl->current_dev;
4152         if (!dev)
4153                 return dev;
4154         if (dev != orig_dev) {
4155                 if (b43_status(dev) >= B43_STAT_STARTED)
4156                         goto redo;
4157                 return dev;
4158         }
4159         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4160         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4161
4162         /* Drain the TX queue */
4163         while (skb_queue_len(&wl->tx_queue))
4164                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4165
4166         b43_mac_suspend(dev);
4167         b43_leds_exit(dev);
4168         b43dbg(wl, "Wireless interface stopped\n");
4169
4170         return dev;
4171 }
4172
4173 /* Locking: wl->mutex */
4174 static int b43_wireless_core_start(struct b43_wldev *dev)
4175 {
4176         int err;
4177
4178         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4179
4180         drain_txstatus_queue(dev);
4181         if (b43_bus_host_is_sdio(dev->dev)) {
4182                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4183                 if (err) {
4184                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4185                         goto out;
4186                 }
4187         } else {
4188                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4189                                            b43_interrupt_thread_handler,
4190                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4191                 if (err) {
4192                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4193                                dev->dev->irq);
4194                         goto out;
4195                 }
4196         }
4197
4198         /* We are ready to run. */
4199         ieee80211_wake_queues(dev->wl->hw);
4200         b43_set_status(dev, B43_STAT_STARTED);
4201
4202         /* Start data flow (TX/RX). */
4203         b43_mac_enable(dev);
4204         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4205
4206         /* Start maintenance work */
4207         b43_periodic_tasks_setup(dev);
4208
4209         b43_leds_init(dev);
4210
4211         b43dbg(dev->wl, "Wireless interface started\n");
4212 out:
4213         return err;
4214 }
4215
4216 /* Get PHY and RADIO versioning numbers */
4217 static int b43_phy_versioning(struct b43_wldev *dev)
4218 {
4219         struct b43_phy *phy = &dev->phy;
4220         u32 tmp;
4221         u8 analog_type;
4222         u8 phy_type;
4223         u8 phy_rev;
4224         u16 radio_manuf;
4225         u16 radio_ver;
4226         u16 radio_rev;
4227         int unsupported = 0;
4228
4229         /* Get PHY versioning */
4230         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4231         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4232         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4233         phy_rev = (tmp & B43_PHYVER_VERSION);
4234         switch (phy_type) {
4235         case B43_PHYTYPE_A:
4236                 if (phy_rev >= 4)
4237                         unsupported = 1;
4238                 break;
4239         case B43_PHYTYPE_B:
4240                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4241                     && phy_rev != 7)
4242                         unsupported = 1;
4243                 break;
4244         case B43_PHYTYPE_G:
4245                 if (phy_rev > 9)
4246                         unsupported = 1;
4247                 break;
4248 #ifdef CONFIG_B43_PHY_N
4249         case B43_PHYTYPE_N:
4250                 if (phy_rev > 9)
4251                         unsupported = 1;
4252                 break;
4253 #endif
4254 #ifdef CONFIG_B43_PHY_LP
4255         case B43_PHYTYPE_LP:
4256                 if (phy_rev > 2)
4257                         unsupported = 1;
4258                 break;
4259 #endif
4260 #ifdef CONFIG_B43_PHY_HT
4261         case B43_PHYTYPE_HT:
4262                 if (phy_rev > 1)
4263                         unsupported = 1;
4264                 break;
4265 #endif
4266 #ifdef CONFIG_B43_PHY_LCN
4267         case B43_PHYTYPE_LCN:
4268                 if (phy_rev > 1)
4269                         unsupported = 1;
4270                 break;
4271 #endif
4272         default:
4273                 unsupported = 1;
4274         }
4275         if (unsupported) {
4276                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4277                        "(Analog %u, Type %u, Revision %u)\n",
4278                        analog_type, phy_type, phy_rev);
4279                 return -EOPNOTSUPP;
4280         }
4281         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4282                analog_type, phy_type, phy_rev);
4283
4284         /* Get RADIO versioning */
4285         if (dev->dev->core_rev >= 24) {
4286                 u16 radio24[3];
4287
4288                 for (tmp = 0; tmp < 3; tmp++) {
4289                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4290                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4291                 }
4292
4293                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4294                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4295
4296                 radio_manuf = 0x17F;
4297                 radio_ver = (radio24[2] << 8) | radio24[1];
4298                 radio_rev = (radio24[0] & 0xF);
4299         } else {
4300                 if (dev->dev->chip_id == 0x4317) {
4301                         if (dev->dev->chip_rev == 0)
4302                                 tmp = 0x3205017F;
4303                         else if (dev->dev->chip_rev == 1)
4304                                 tmp = 0x4205017F;
4305                         else
4306                                 tmp = 0x5205017F;
4307                 } else {
4308                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4309                                     B43_RADIOCTL_ID);
4310                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4311                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4312                                     B43_RADIOCTL_ID);
4313                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4314                                 << 16;
4315                 }
4316                 radio_manuf = (tmp & 0x00000FFF);
4317                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4318                 radio_rev = (tmp & 0xF0000000) >> 28;
4319         }
4320
4321         if (radio_manuf != 0x17F /* Broadcom */)
4322                 unsupported = 1;
4323         switch (phy_type) {
4324         case B43_PHYTYPE_A:
4325                 if (radio_ver != 0x2060)
4326                         unsupported = 1;
4327                 if (radio_rev != 1)
4328                         unsupported = 1;
4329                 if (radio_manuf != 0x17F)
4330                         unsupported = 1;
4331                 break;
4332         case B43_PHYTYPE_B:
4333                 if ((radio_ver & 0xFFF0) != 0x2050)
4334                         unsupported = 1;
4335                 break;
4336         case B43_PHYTYPE_G:
4337                 if (radio_ver != 0x2050)
4338                         unsupported = 1;
4339                 break;
4340         case B43_PHYTYPE_N:
4341                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4342                         unsupported = 1;
4343                 break;
4344         case B43_PHYTYPE_LP:
4345                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4346                         unsupported = 1;
4347                 break;
4348         case B43_PHYTYPE_HT:
4349                 if (radio_ver != 0x2059)
4350                         unsupported = 1;
4351                 break;
4352         case B43_PHYTYPE_LCN:
4353                 if (radio_ver != 0x2064)
4354                         unsupported = 1;
4355                 break;
4356         default:
4357                 B43_WARN_ON(1);
4358         }
4359         if (unsupported) {
4360                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4361                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4362                        radio_manuf, radio_ver, radio_rev);
4363                 return -EOPNOTSUPP;
4364         }
4365         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4366                radio_manuf, radio_ver, radio_rev);
4367
4368         phy->radio_manuf = radio_manuf;
4369         phy->radio_ver = radio_ver;
4370         phy->radio_rev = radio_rev;
4371
4372         phy->analog = analog_type;
4373         phy->type = phy_type;
4374         phy->rev = phy_rev;
4375
4376         return 0;
4377 }
4378
4379 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4380                                       struct b43_phy *phy)
4381 {
4382         phy->hardware_power_control = !!modparam_hwpctl;
4383         phy->next_txpwr_check_time = jiffies;
4384         /* PHY TX errors counter. */
4385         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4386
4387 #if B43_DEBUG
4388         phy->phy_locked = 0;
4389         phy->radio_locked = 0;
4390 #endif
4391 }
4392
4393 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4394 {
4395         dev->dfq_valid = 0;
4396
4397         /* Assume the radio is enabled. If it's not enabled, the state will
4398          * immediately get fixed on the first periodic work run. */
4399         dev->radio_hw_enable = 1;
4400
4401         /* Stats */
4402         memset(&dev->stats, 0, sizeof(dev->stats));
4403
4404         setup_struct_phy_for_init(dev, &dev->phy);
4405
4406         /* IRQ related flags */
4407         dev->irq_reason = 0;
4408         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4409         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4410         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4411                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4412
4413         dev->mac_suspended = 1;
4414
4415         /* Noise calculation context */
4416         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4417 }
4418
4419 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4420 {
4421         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4422         u64 hf;
4423
4424         if (!modparam_btcoex)
4425                 return;
4426         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4427                 return;
4428         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4429                 return;
4430
4431         hf = b43_hf_read(dev);
4432         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4433                 hf |= B43_HF_BTCOEXALT;
4434         else
4435                 hf |= B43_HF_BTCOEX;
4436         b43_hf_write(dev, hf);
4437 }
4438
4439 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4440 {
4441         if (!modparam_btcoex)
4442                 return;
4443         //TODO
4444 }
4445
4446 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4447 {
4448         struct ssb_bus *bus;
4449         u32 tmp;
4450
4451         if (dev->dev->bus_type != B43_BUS_SSB)
4452                 return;
4453
4454         bus = dev->dev->sdev->bus;
4455
4456         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4457             (bus->chip_id == 0x4312)) {
4458                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4459                 tmp &= ~SSB_IMCFGLO_REQTO;
4460                 tmp &= ~SSB_IMCFGLO_SERTO;
4461                 tmp |= 0x3;
4462                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4463                 ssb_commit_settings(bus);
4464         }
4465 }
4466
4467 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4468 {
4469         u16 pu_delay;
4470
4471         /* The time value is in microseconds. */
4472         if (dev->phy.type == B43_PHYTYPE_A)
4473                 pu_delay = 3700;
4474         else
4475                 pu_delay = 1050;
4476         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4477                 pu_delay = 500;
4478         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4479                 pu_delay = max(pu_delay, (u16)2400);
4480
4481         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4482 }
4483
4484 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4485 static void b43_set_pretbtt(struct b43_wldev *dev)
4486 {
4487         u16 pretbtt;
4488
4489         /* The time value is in microseconds. */
4490         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4491                 pretbtt = 2;
4492         } else {
4493                 if (dev->phy.type == B43_PHYTYPE_A)
4494                         pretbtt = 120;
4495                 else
4496                         pretbtt = 250;
4497         }
4498         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4499         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4500 }
4501
4502 /* Shutdown a wireless core */
4503 /* Locking: wl->mutex */
4504 static void b43_wireless_core_exit(struct b43_wldev *dev)
4505 {
4506         u32 macctl;
4507
4508         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4509         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4510                 return;
4511
4512         /* Unregister HW RNG driver */
4513         b43_rng_exit(dev->wl);
4514
4515         b43_set_status(dev, B43_STAT_UNINIT);
4516
4517         /* Stop the microcode PSM. */
4518         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4519         macctl &= ~B43_MACCTL_PSM_RUN;
4520         macctl |= B43_MACCTL_PSM_JMP0;
4521         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4522
4523         b43_dma_free(dev);
4524         b43_pio_free(dev);
4525         b43_chip_exit(dev);
4526         dev->phy.ops->switch_analog(dev, 0);
4527         if (dev->wl->current_beacon) {
4528                 dev_kfree_skb_any(dev->wl->current_beacon);
4529                 dev->wl->current_beacon = NULL;
4530         }
4531
4532         b43_device_disable(dev, 0);
4533         b43_bus_may_powerdown(dev);
4534 }
4535
4536 /* Initialize a wireless core */
4537 static int b43_wireless_core_init(struct b43_wldev *dev)
4538 {
4539         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4540         struct b43_phy *phy = &dev->phy;
4541         int err;
4542         u64 hf;
4543
4544         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4545
4546         err = b43_bus_powerup(dev, 0);
4547         if (err)
4548                 goto out;
4549         if (!b43_device_is_enabled(dev))
4550                 b43_wireless_core_reset(dev, phy->gmode);
4551
4552         /* Reset all data structures. */
4553         setup_struct_wldev_for_init(dev);
4554         phy->ops->prepare_structs(dev);
4555
4556         /* Enable IRQ routing to this device. */
4557         switch (dev->dev->bus_type) {
4558 #ifdef CONFIG_B43_BCMA
4559         case B43_BUS_BCMA:
4560                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4561                                       dev->dev->bdev, true);
4562                 break;
4563 #endif
4564 #ifdef CONFIG_B43_SSB
4565         case B43_BUS_SSB:
4566                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4567                                                dev->dev->sdev);
4568                 break;
4569 #endif
4570         }
4571
4572         b43_imcfglo_timeouts_workaround(dev);
4573         b43_bluetooth_coext_disable(dev);
4574         if (phy->ops->prepare_hardware) {
4575                 err = phy->ops->prepare_hardware(dev);
4576                 if (err)
4577                         goto err_busdown;
4578         }
4579         err = b43_chip_init(dev);
4580         if (err)
4581                 goto err_busdown;
4582         b43_shm_write16(dev, B43_SHM_SHARED,
4583                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4584         hf = b43_hf_read(dev);
4585         if (phy->type == B43_PHYTYPE_G) {
4586                 hf |= B43_HF_SYMW;
4587                 if (phy->rev == 1)
4588                         hf |= B43_HF_GDCW;
4589                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4590                         hf |= B43_HF_OFDMPABOOST;
4591         }
4592         if (phy->radio_ver == 0x2050) {
4593                 if (phy->radio_rev == 6)
4594                         hf |= B43_HF_4318TSSI;
4595                 if (phy->radio_rev < 6)
4596                         hf |= B43_HF_VCORECALC;
4597         }
4598         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4599                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4600 #ifdef CONFIG_SSB_DRIVER_PCICORE
4601         if (dev->dev->bus_type == B43_BUS_SSB &&
4602             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4603             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4604                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4605 #endif
4606         hf &= ~B43_HF_SKCFPUP;
4607         b43_hf_write(dev, hf);
4608
4609         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4610                              B43_DEFAULT_LONG_RETRY_LIMIT);
4611         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4612         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4613
4614         /* Disable sending probe responses from firmware.
4615          * Setting the MaxTime to one usec will always trigger
4616          * a timeout, so we never send any probe resp.
4617          * A timeout of zero is infinite. */
4618         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4619
4620         b43_rate_memory_init(dev);
4621         b43_set_phytxctl_defaults(dev);
4622
4623         /* Minimum Contention Window */
4624         if (phy->type == B43_PHYTYPE_B)
4625                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4626         else
4627                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4628         /* Maximum Contention Window */
4629         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4630
4631         if (b43_bus_host_is_pcmcia(dev->dev) ||
4632             b43_bus_host_is_sdio(dev->dev) ||
4633             dev->use_pio) {
4634                 dev->__using_pio_transfers = 1;
4635                 err = b43_pio_init(dev);
4636         } else {
4637                 dev->__using_pio_transfers = 0;
4638                 err = b43_dma_init(dev);
4639         }
4640         if (err)
4641                 goto err_chip_exit;
4642         b43_qos_init(dev);
4643         b43_set_synth_pu_delay(dev, 1);
4644         b43_bluetooth_coext_enable(dev);
4645
4646         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4647         b43_upload_card_macaddress(dev);
4648         b43_security_init(dev);
4649
4650         ieee80211_wake_queues(dev->wl->hw);
4651
4652         b43_set_status(dev, B43_STAT_INITIALIZED);
4653
4654         /* Register HW RNG driver */
4655         b43_rng_init(dev->wl);
4656
4657 out:
4658         return err;
4659
4660 err_chip_exit:
4661         b43_chip_exit(dev);
4662 err_busdown:
4663         b43_bus_may_powerdown(dev);
4664         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4665         return err;
4666 }
4667
4668 static int b43_op_add_interface(struct ieee80211_hw *hw,
4669                                 struct ieee80211_vif *vif)
4670 {
4671         struct b43_wl *wl = hw_to_b43_wl(hw);
4672         struct b43_wldev *dev;
4673         int err = -EOPNOTSUPP;
4674
4675         /* TODO: allow WDS/AP devices to coexist */
4676
4677         if (vif->type != NL80211_IFTYPE_AP &&
4678             vif->type != NL80211_IFTYPE_MESH_POINT &&
4679             vif->type != NL80211_IFTYPE_STATION &&
4680             vif->type != NL80211_IFTYPE_WDS &&
4681             vif->type != NL80211_IFTYPE_ADHOC)
4682                 return -EOPNOTSUPP;
4683
4684         mutex_lock(&wl->mutex);
4685         if (wl->operating)
4686                 goto out_mutex_unlock;
4687
4688         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4689
4690         dev = wl->current_dev;
4691         wl->operating = 1;
4692         wl->vif = vif;
4693         wl->if_type = vif->type;
4694         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4695
4696         b43_adjust_opmode(dev);
4697         b43_set_pretbtt(dev);
4698         b43_set_synth_pu_delay(dev, 0);
4699         b43_upload_card_macaddress(dev);
4700
4701         err = 0;
4702  out_mutex_unlock:
4703         mutex_unlock(&wl->mutex);
4704
4705         return err;
4706 }
4707
4708 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4709                                     struct ieee80211_vif *vif)
4710 {
4711         struct b43_wl *wl = hw_to_b43_wl(hw);
4712         struct b43_wldev *dev = wl->current_dev;
4713
4714         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4715
4716         mutex_lock(&wl->mutex);
4717
4718         B43_WARN_ON(!wl->operating);
4719         B43_WARN_ON(wl->vif != vif);
4720         wl->vif = NULL;
4721
4722         wl->operating = 0;
4723
4724         b43_adjust_opmode(dev);
4725         memset(wl->mac_addr, 0, ETH_ALEN);
4726         b43_upload_card_macaddress(dev);
4727
4728         mutex_unlock(&wl->mutex);
4729 }
4730
4731 static int b43_op_start(struct ieee80211_hw *hw)
4732 {
4733         struct b43_wl *wl = hw_to_b43_wl(hw);
4734         struct b43_wldev *dev = wl->current_dev;
4735         int did_init = 0;
4736         int err = 0;
4737
4738         /* Kill all old instance specific information to make sure
4739          * the card won't use it in the short timeframe between start
4740          * and mac80211 reconfiguring it. */
4741         memset(wl->bssid, 0, ETH_ALEN);
4742         memset(wl->mac_addr, 0, ETH_ALEN);
4743         wl->filter_flags = 0;
4744         wl->radiotap_enabled = 0;
4745         b43_qos_clear(wl);
4746         wl->beacon0_uploaded = 0;
4747         wl->beacon1_uploaded = 0;
4748         wl->beacon_templates_virgin = 1;
4749         wl->radio_enabled = 1;
4750
4751         mutex_lock(&wl->mutex);
4752
4753         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4754                 err = b43_wireless_core_init(dev);
4755                 if (err)
4756                         goto out_mutex_unlock;
4757                 did_init = 1;
4758         }
4759
4760         if (b43_status(dev) < B43_STAT_STARTED) {
4761                 err = b43_wireless_core_start(dev);
4762                 if (err) {
4763                         if (did_init)
4764                                 b43_wireless_core_exit(dev);
4765                         goto out_mutex_unlock;
4766                 }
4767         }
4768
4769         /* XXX: only do if device doesn't support rfkill irq */
4770         wiphy_rfkill_start_polling(hw->wiphy);
4771
4772  out_mutex_unlock:
4773         mutex_unlock(&wl->mutex);
4774
4775         return err;
4776 }
4777
4778 static void b43_op_stop(struct ieee80211_hw *hw)
4779 {
4780         struct b43_wl *wl = hw_to_b43_wl(hw);
4781         struct b43_wldev *dev = wl->current_dev;
4782
4783         cancel_work_sync(&(wl->beacon_update_trigger));
4784
4785         mutex_lock(&wl->mutex);
4786         if (b43_status(dev) >= B43_STAT_STARTED) {
4787                 dev = b43_wireless_core_stop(dev);
4788                 if (!dev)
4789                         goto out_unlock;
4790         }
4791         b43_wireless_core_exit(dev);
4792         wl->radio_enabled = 0;
4793
4794 out_unlock:
4795         mutex_unlock(&wl->mutex);
4796
4797         cancel_work_sync(&(wl->txpower_adjust_work));
4798 }
4799
4800 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4801                                  struct ieee80211_sta *sta, bool set)
4802 {
4803         struct b43_wl *wl = hw_to_b43_wl(hw);
4804
4805         /* FIXME: add locking */
4806         b43_update_templates(wl);
4807
4808         return 0;
4809 }
4810
4811 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4812                               struct ieee80211_vif *vif,
4813                               enum sta_notify_cmd notify_cmd,
4814                               struct ieee80211_sta *sta)
4815 {
4816         struct b43_wl *wl = hw_to_b43_wl(hw);
4817
4818         B43_WARN_ON(!vif || wl->vif != vif);
4819 }
4820
4821 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4822 {
4823         struct b43_wl *wl = hw_to_b43_wl(hw);
4824         struct b43_wldev *dev;
4825
4826         mutex_lock(&wl->mutex);
4827         dev = wl->current_dev;
4828         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4829                 /* Disable CFP update during scan on other channels. */
4830                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4831         }
4832         mutex_unlock(&wl->mutex);
4833 }
4834
4835 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4836 {
4837         struct b43_wl *wl = hw_to_b43_wl(hw);
4838         struct b43_wldev *dev;
4839
4840         mutex_lock(&wl->mutex);
4841         dev = wl->current_dev;
4842         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4843                 /* Re-enable CFP update. */
4844                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4845         }
4846         mutex_unlock(&wl->mutex);
4847 }
4848
4849 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4850                              struct survey_info *survey)
4851 {
4852         struct b43_wl *wl = hw_to_b43_wl(hw);
4853         struct b43_wldev *dev = wl->current_dev;
4854         struct ieee80211_conf *conf = &hw->conf;
4855
4856         if (idx != 0)
4857                 return -ENOENT;
4858
4859         survey->channel = conf->channel;
4860         survey->filled = SURVEY_INFO_NOISE_DBM;
4861         survey->noise = dev->stats.link_noise;
4862
4863         return 0;
4864 }
4865
4866 static const struct ieee80211_ops b43_hw_ops = {
4867         .tx                     = b43_op_tx,
4868         .conf_tx                = b43_op_conf_tx,
4869         .add_interface          = b43_op_add_interface,
4870         .remove_interface       = b43_op_remove_interface,
4871         .config                 = b43_op_config,
4872         .bss_info_changed       = b43_op_bss_info_changed,
4873         .configure_filter       = b43_op_configure_filter,
4874         .set_key                = b43_op_set_key,
4875         .update_tkip_key        = b43_op_update_tkip_key,
4876         .get_stats              = b43_op_get_stats,
4877         .get_tsf                = b43_op_get_tsf,
4878         .set_tsf                = b43_op_set_tsf,
4879         .start                  = b43_op_start,
4880         .stop                   = b43_op_stop,
4881         .set_tim                = b43_op_beacon_set_tim,
4882         .sta_notify             = b43_op_sta_notify,
4883         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4884         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4885         .get_survey             = b43_op_get_survey,
4886         .rfkill_poll            = b43_rfkill_poll,
4887 };
4888
4889 /* Hard-reset the chip. Do not call this directly.
4890  * Use b43_controller_restart()
4891  */
4892 static void b43_chip_reset(struct work_struct *work)
4893 {
4894         struct b43_wldev *dev =
4895             container_of(work, struct b43_wldev, restart_work);
4896         struct b43_wl *wl = dev->wl;
4897         int err = 0;
4898         int prev_status;
4899
4900         mutex_lock(&wl->mutex);
4901
4902         prev_status = b43_status(dev);
4903         /* Bring the device down... */
4904         if (prev_status >= B43_STAT_STARTED) {
4905                 dev = b43_wireless_core_stop(dev);
4906                 if (!dev) {
4907                         err = -ENODEV;
4908                         goto out;
4909                 }
4910         }
4911         if (prev_status >= B43_STAT_INITIALIZED)
4912                 b43_wireless_core_exit(dev);
4913
4914         /* ...and up again. */
4915         if (prev_status >= B43_STAT_INITIALIZED) {
4916                 err = b43_wireless_core_init(dev);
4917                 if (err)
4918                         goto out;
4919         }
4920         if (prev_status >= B43_STAT_STARTED) {
4921                 err = b43_wireless_core_start(dev);
4922                 if (err) {
4923                         b43_wireless_core_exit(dev);
4924                         goto out;
4925                 }
4926         }
4927 out:
4928         if (err)
4929                 wl->current_dev = NULL; /* Failed to init the dev. */
4930         mutex_unlock(&wl->mutex);
4931         if (err)
4932                 b43err(wl, "Controller restart FAILED\n");
4933         else
4934                 b43info(wl, "Controller restarted\n");
4935 }
4936
4937 static int b43_setup_bands(struct b43_wldev *dev,
4938                            bool have_2ghz_phy, bool have_5ghz_phy)
4939 {
4940         struct ieee80211_hw *hw = dev->wl->hw;
4941
4942         if (have_2ghz_phy)
4943                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4944         if (dev->phy.type == B43_PHYTYPE_N) {
4945                 if (have_5ghz_phy)
4946                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4947         } else {
4948                 if (have_5ghz_phy)
4949                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4950         }
4951
4952         dev->phy.supports_2ghz = have_2ghz_phy;
4953         dev->phy.supports_5ghz = have_5ghz_phy;
4954
4955         return 0;
4956 }
4957
4958 static void b43_wireless_core_detach(struct b43_wldev *dev)
4959 {
4960         /* We release firmware that late to not be required to re-request
4961          * is all the time when we reinit the core. */
4962         b43_release_firmware(dev);
4963         b43_phy_free(dev);
4964 }
4965
4966 static int b43_wireless_core_attach(struct b43_wldev *dev)
4967 {
4968         struct b43_wl *wl = dev->wl;
4969         struct pci_dev *pdev = NULL;
4970         int err;
4971         u32 tmp;
4972         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4973
4974         /* Do NOT do any device initialization here.
4975          * Do it in wireless_core_init() instead.
4976          * This function is for gathering basic information about the HW, only.
4977          * Also some structs may be set up here. But most likely you want to have
4978          * that in core_init(), too.
4979          */
4980
4981 #ifdef CONFIG_B43_SSB
4982         if (dev->dev->bus_type == B43_BUS_SSB &&
4983             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4984                 pdev = dev->dev->sdev->bus->host_pci;
4985 #endif
4986
4987         err = b43_bus_powerup(dev, 0);
4988         if (err) {
4989                 b43err(wl, "Bus powerup failed\n");
4990                 goto out;
4991         }
4992
4993         /* Get the PHY type. */
4994         switch (dev->dev->bus_type) {
4995 #ifdef CONFIG_B43_BCMA
4996         case B43_BUS_BCMA:
4997                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
4998                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
4999                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5000                 break;
5001 #endif
5002 #ifdef CONFIG_B43_SSB
5003         case B43_BUS_SSB:
5004                 if (dev->dev->core_rev >= 5) {
5005                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5006                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5007                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5008                 } else
5009                         B43_WARN_ON(1);
5010                 break;
5011 #endif
5012         }
5013
5014         dev->phy.gmode = have_2ghz_phy;
5015         dev->phy.radio_on = 1;
5016         b43_wireless_core_reset(dev, dev->phy.gmode);
5017
5018         err = b43_phy_versioning(dev);
5019         if (err)
5020                 goto err_powerdown;
5021         /* Check if this device supports multiband. */
5022         if (!pdev ||
5023             (pdev->device != 0x4312 &&
5024              pdev->device != 0x4319 && pdev->device != 0x4324)) {
5025                 /* No multiband support. */
5026                 have_2ghz_phy = 0;
5027                 have_5ghz_phy = 0;
5028                 switch (dev->phy.type) {
5029                 case B43_PHYTYPE_A:
5030                         have_5ghz_phy = 1;
5031                         break;
5032                 case B43_PHYTYPE_LP: //FIXME not always!
5033 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
5034                         have_5ghz_phy = 1;
5035 #endif
5036                 case B43_PHYTYPE_G:
5037                 case B43_PHYTYPE_N:
5038                 case B43_PHYTYPE_HT:
5039                 case B43_PHYTYPE_LCN:
5040                         have_2ghz_phy = 1;
5041                         break;
5042                 default:
5043                         B43_WARN_ON(1);
5044                 }
5045         }
5046         if (dev->phy.type == B43_PHYTYPE_A) {
5047                 /* FIXME */
5048                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
5049                 err = -EOPNOTSUPP;
5050                 goto err_powerdown;
5051         }
5052         if (1 /* disable A-PHY */) {
5053                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
5054                 if (dev->phy.type != B43_PHYTYPE_N &&
5055                     dev->phy.type != B43_PHYTYPE_LP) {
5056                         have_2ghz_phy = 1;
5057                         have_5ghz_phy = 0;
5058                 }
5059         }
5060
5061         err = b43_phy_allocate(dev);
5062         if (err)
5063                 goto err_powerdown;
5064
5065         dev->phy.gmode = have_2ghz_phy;
5066         b43_wireless_core_reset(dev, dev->phy.gmode);
5067
5068         err = b43_validate_chipaccess(dev);
5069         if (err)
5070                 goto err_phy_free;
5071         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5072         if (err)
5073                 goto err_phy_free;
5074
5075         /* Now set some default "current_dev" */
5076         if (!wl->current_dev)
5077                 wl->current_dev = dev;
5078         INIT_WORK(&dev->restart_work, b43_chip_reset);
5079
5080         dev->phy.ops->switch_analog(dev, 0);
5081         b43_device_disable(dev, 0);
5082         b43_bus_may_powerdown(dev);
5083
5084 out:
5085         return err;
5086
5087 err_phy_free:
5088         b43_phy_free(dev);
5089 err_powerdown:
5090         b43_bus_may_powerdown(dev);
5091         return err;
5092 }
5093
5094 static void b43_one_core_detach(struct b43_bus_dev *dev)
5095 {
5096         struct b43_wldev *wldev;
5097         struct b43_wl *wl;
5098
5099         /* Do not cancel ieee80211-workqueue based work here.
5100          * See comment in b43_remove(). */
5101
5102         wldev = b43_bus_get_wldev(dev);
5103         wl = wldev->wl;
5104         b43_debugfs_remove_device(wldev);
5105         b43_wireless_core_detach(wldev);
5106         list_del(&wldev->list);
5107         wl->nr_devs--;
5108         b43_bus_set_wldev(dev, NULL);
5109         kfree(wldev);
5110 }
5111
5112 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5113 {
5114         struct b43_wldev *wldev;
5115         int err = -ENOMEM;
5116
5117         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5118         if (!wldev)
5119                 goto out;
5120
5121         wldev->use_pio = b43_modparam_pio;
5122         wldev->dev = dev;
5123         wldev->wl = wl;
5124         b43_set_status(wldev, B43_STAT_UNINIT);
5125         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5126         INIT_LIST_HEAD(&wldev->list);
5127
5128         err = b43_wireless_core_attach(wldev);
5129         if (err)
5130                 goto err_kfree_wldev;
5131
5132         list_add(&wldev->list, &wl->devlist);
5133         wl->nr_devs++;
5134         b43_bus_set_wldev(dev, wldev);
5135         b43_debugfs_add_device(wldev);
5136
5137       out:
5138         return err;
5139
5140       err_kfree_wldev:
5141         kfree(wldev);
5142         return err;
5143 }
5144
5145 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5146         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5147         (pdev->device == _device) &&                                    \
5148         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5149         (pdev->subsystem_device == _subdevice)                          )
5150
5151 static void b43_sprom_fixup(struct ssb_bus *bus)
5152 {
5153         struct pci_dev *pdev;
5154
5155         /* boardflags workarounds */
5156         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5157             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5158                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5159         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5160             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5161                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5162         if (bus->bustype == SSB_BUSTYPE_PCI) {
5163                 pdev = bus->host_pci;
5164                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5165                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5166                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5167                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5168                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5169                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5170                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5171                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5172         }
5173 }
5174
5175 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5176 {
5177         struct ieee80211_hw *hw = wl->hw;
5178
5179         ssb_set_devtypedata(dev->sdev, NULL);
5180         ieee80211_free_hw(hw);
5181 }
5182
5183 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5184 {
5185         struct ssb_sprom *sprom = dev->bus_sprom;
5186         struct ieee80211_hw *hw;
5187         struct b43_wl *wl;
5188         char chip_name[6];
5189
5190         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5191         if (!hw) {
5192                 b43err(NULL, "Could not allocate ieee80211 device\n");
5193                 return ERR_PTR(-ENOMEM);
5194         }
5195         wl = hw_to_b43_wl(hw);
5196
5197         /* fill hw info */
5198         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5199                     IEEE80211_HW_SIGNAL_DBM;
5200
5201         hw->wiphy->interface_modes =
5202                 BIT(NL80211_IFTYPE_AP) |
5203                 BIT(NL80211_IFTYPE_MESH_POINT) |
5204                 BIT(NL80211_IFTYPE_STATION) |
5205                 BIT(NL80211_IFTYPE_WDS) |
5206                 BIT(NL80211_IFTYPE_ADHOC);
5207
5208         hw->queues = modparam_qos ? 4 : 1;
5209         wl->mac80211_initially_registered_queues = hw->queues;
5210         hw->max_rates = 2;
5211         SET_IEEE80211_DEV(hw, dev->dev);
5212         if (is_valid_ether_addr(sprom->et1mac))
5213                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5214         else
5215                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5216
5217         /* Initialize struct b43_wl */
5218         wl->hw = hw;
5219         mutex_init(&wl->mutex);
5220         spin_lock_init(&wl->hardirq_lock);
5221         INIT_LIST_HEAD(&wl->devlist);
5222         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5223         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5224         INIT_WORK(&wl->tx_work, b43_tx_work);
5225         skb_queue_head_init(&wl->tx_queue);
5226
5227         snprintf(chip_name, ARRAY_SIZE(chip_name),
5228                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5229         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5230                 dev->core_rev);
5231         return wl;
5232 }
5233
5234 #ifdef CONFIG_B43_BCMA
5235 static int b43_bcma_probe(struct bcma_device *core)
5236 {
5237         struct b43_bus_dev *dev;
5238         struct b43_wl *wl;
5239         int err;
5240
5241         dev = b43_bus_dev_bcma_init(core);
5242         if (!dev)
5243                 return -ENODEV;
5244
5245         wl = b43_wireless_init(dev);
5246         if (IS_ERR(wl)) {
5247                 err = PTR_ERR(wl);
5248                 goto bcma_out;
5249         }
5250
5251         err = b43_one_core_attach(dev, wl);
5252         if (err)
5253                 goto bcma_err_wireless_exit;
5254
5255         err = ieee80211_register_hw(wl->hw);
5256         if (err)
5257                 goto bcma_err_one_core_detach;
5258         b43_leds_register(wl->current_dev);
5259
5260 bcma_out:
5261         return err;
5262
5263 bcma_err_one_core_detach:
5264         b43_one_core_detach(dev);
5265 bcma_err_wireless_exit:
5266         ieee80211_free_hw(wl->hw);
5267         return err;
5268 }
5269
5270 static void b43_bcma_remove(struct bcma_device *core)
5271 {
5272         struct b43_wldev *wldev = bcma_get_drvdata(core);
5273         struct b43_wl *wl = wldev->wl;
5274
5275         /* We must cancel any work here before unregistering from ieee80211,
5276          * as the ieee80211 unreg will destroy the workqueue. */
5277         cancel_work_sync(&wldev->restart_work);
5278
5279         /* Restore the queues count before unregistering, because firmware detect
5280          * might have modified it. Restoring is important, so the networking
5281          * stack can properly free resources. */
5282         wl->hw->queues = wl->mac80211_initially_registered_queues;
5283         b43_leds_stop(wldev);
5284         ieee80211_unregister_hw(wl->hw);
5285
5286         b43_one_core_detach(wldev->dev);
5287
5288         b43_leds_unregister(wl);
5289
5290         ieee80211_free_hw(wl->hw);
5291 }
5292
5293 static struct bcma_driver b43_bcma_driver = {
5294         .name           = KBUILD_MODNAME,
5295         .id_table       = b43_bcma_tbl,
5296         .probe          = b43_bcma_probe,
5297         .remove         = b43_bcma_remove,
5298 };
5299 #endif
5300
5301 #ifdef CONFIG_B43_SSB
5302 static
5303 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5304 {
5305         struct b43_bus_dev *dev;
5306         struct b43_wl *wl;
5307         int err;
5308         int first = 0;
5309
5310         dev = b43_bus_dev_ssb_init(sdev);
5311         if (!dev)
5312                 return -ENOMEM;
5313
5314         wl = ssb_get_devtypedata(sdev);
5315         if (!wl) {
5316                 /* Probing the first core. Must setup common struct b43_wl */
5317                 first = 1;
5318                 b43_sprom_fixup(sdev->bus);
5319                 wl = b43_wireless_init(dev);
5320                 if (IS_ERR(wl)) {
5321                         err = PTR_ERR(wl);
5322                         goto out;
5323                 }
5324                 ssb_set_devtypedata(sdev, wl);
5325                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5326         }
5327         err = b43_one_core_attach(dev, wl);
5328         if (err)
5329                 goto err_wireless_exit;
5330
5331         if (first) {
5332                 err = ieee80211_register_hw(wl->hw);
5333                 if (err)
5334                         goto err_one_core_detach;
5335                 b43_leds_register(wl->current_dev);
5336         }
5337
5338       out:
5339         return err;
5340
5341       err_one_core_detach:
5342         b43_one_core_detach(dev);
5343       err_wireless_exit:
5344         if (first)
5345                 b43_wireless_exit(dev, wl);
5346         return err;
5347 }
5348
5349 static void b43_ssb_remove(struct ssb_device *sdev)
5350 {
5351         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5352         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5353
5354         /* We must cancel any work here before unregistering from ieee80211,
5355          * as the ieee80211 unreg will destroy the workqueue. */
5356         cancel_work_sync(&wldev->restart_work);
5357
5358         B43_WARN_ON(!wl);
5359         if (wl->current_dev == wldev) {
5360                 /* Restore the queues count before unregistering, because firmware detect
5361                  * might have modified it. Restoring is important, so the networking
5362                  * stack can properly free resources. */
5363                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5364                 b43_leds_stop(wldev);
5365                 ieee80211_unregister_hw(wl->hw);
5366         }
5367
5368         b43_one_core_detach(wldev->dev);
5369
5370         if (list_empty(&wl->devlist)) {
5371                 b43_leds_unregister(wl);
5372                 /* Last core on the chip unregistered.
5373                  * We can destroy common struct b43_wl.
5374                  */
5375                 b43_wireless_exit(wldev->dev, wl);
5376         }
5377 }
5378
5379 static struct ssb_driver b43_ssb_driver = {
5380         .name           = KBUILD_MODNAME,
5381         .id_table       = b43_ssb_tbl,
5382         .probe          = b43_ssb_probe,
5383         .remove         = b43_ssb_remove,
5384 };
5385 #endif /* CONFIG_B43_SSB */
5386
5387 /* Perform a hardware reset. This can be called from any context. */
5388 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5389 {
5390         /* Must avoid requeueing, if we are in shutdown. */
5391         if (b43_status(dev) < B43_STAT_INITIALIZED)
5392                 return;
5393         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5394         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5395 }
5396
5397 static void b43_print_driverinfo(void)
5398 {
5399         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5400                    *feat_leds = "", *feat_sdio = "";
5401
5402 #ifdef CONFIG_B43_PCI_AUTOSELECT
5403         feat_pci = "P";
5404 #endif
5405 #ifdef CONFIG_B43_PCMCIA
5406         feat_pcmcia = "M";
5407 #endif
5408 #ifdef CONFIG_B43_PHY_N
5409         feat_nphy = "N";
5410 #endif
5411 #ifdef CONFIG_B43_LEDS
5412         feat_leds = "L";
5413 #endif
5414 #ifdef CONFIG_B43_SDIO
5415         feat_sdio = "S";
5416 #endif
5417         printk(KERN_INFO "Broadcom 43xx driver loaded "
5418                "[ Features: %s%s%s%s%s, Firmware-ID: "
5419                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5420                feat_pci, feat_pcmcia, feat_nphy,
5421                feat_leds, feat_sdio);
5422 }
5423
5424 static int __init b43_init(void)
5425 {
5426         int err;
5427
5428         b43_debugfs_init();
5429         err = b43_pcmcia_init();
5430         if (err)
5431                 goto err_dfs_exit;
5432         err = b43_sdio_init();
5433         if (err)
5434                 goto err_pcmcia_exit;
5435 #ifdef CONFIG_B43_BCMA
5436         err = bcma_driver_register(&b43_bcma_driver);
5437         if (err)
5438                 goto err_sdio_exit;
5439 #endif
5440 #ifdef CONFIG_B43_SSB
5441         err = ssb_driver_register(&b43_ssb_driver);
5442         if (err)
5443                 goto err_bcma_driver_exit;
5444 #endif
5445         b43_print_driverinfo();
5446
5447         return err;
5448
5449 #ifdef CONFIG_B43_SSB
5450 err_bcma_driver_exit:
5451 #endif
5452 #ifdef CONFIG_B43_BCMA
5453         bcma_driver_unregister(&b43_bcma_driver);
5454 err_sdio_exit:
5455 #endif
5456         b43_sdio_exit();
5457 err_pcmcia_exit:
5458         b43_pcmcia_exit();
5459 err_dfs_exit:
5460         b43_debugfs_exit();
5461         return err;
5462 }
5463
5464 static void __exit b43_exit(void)
5465 {
5466 #ifdef CONFIG_B43_SSB
5467         ssb_driver_unregister(&b43_ssb_driver);
5468 #endif
5469 #ifdef CONFIG_B43_BCMA
5470         bcma_driver_unregister(&b43_bcma_driver);
5471 #endif
5472         b43_sdio_exit();
5473         b43_pcmcia_exit();
5474         b43_debugfs_exit();
5475 }
5476
5477 module_init(b43_init)
5478 module_exit(b43_exit)