78ddbc7f836b3b9301f5b3a7136d288280263113
[pandora-kernel.git] / drivers / net / wireless / b43 / main.c
1 /*
2
3   Broadcom B43 wireless driver
4
5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11   Some parts of the code in this file are derived from the ipw2200
12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14   This program is free software; you can redistribute it and/or modify
15   it under the terms of the GNU General Public License as published by
16   the Free Software Foundation; either version 2 of the License, or
17   (at your option) any later version.
18
19   This program is distributed in the hope that it will be useful,
20   but WITHOUT ANY WARRANTY; without even the implied warranty of
21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22   GNU General Public License for more details.
23
24   You should have received a copy of the GNU General Public License
25   along with this program; see the file COPYING.  If not, write to
26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27   Boston, MA 02110-1301, USA.
28
29 */
30
31 #include <linux/delay.h>
32 #include <linux/init.h>
33 #include <linux/moduleparam.h>
34 #include <linux/if_arp.h>
35 #include <linux/etherdevice.h>
36 #include <linux/firmware.h>
37 #include <linux/wireless.h>
38 #include <linux/workqueue.h>
39 #include <linux/skbuff.h>
40 #include <linux/io.h>
41 #include <linux/dma-mapping.h>
42 #include <asm/unaligned.h>
43
44 #include "b43.h"
45 #include "main.h"
46 #include "debugfs.h"
47 #include "phy_common.h"
48 #include "phy_g.h"
49 #include "phy_n.h"
50 #include "dma.h"
51 #include "pio.h"
52 #include "sysfs.h"
53 #include "xmit.h"
54 #include "lo.h"
55 #include "pcmcia.h"
56
57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58 MODULE_AUTHOR("Martin Langer");
59 MODULE_AUTHOR("Stefano Brivio");
60 MODULE_AUTHOR("Michael Buesch");
61 MODULE_LICENSE("GPL");
62
63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66 static int modparam_bad_frames_preempt;
67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68 MODULE_PARM_DESC(bad_frames_preempt,
69                  "enable(1) / disable(0) Bad Frames Preemption");
70
71 static char modparam_fwpostfix[16];
72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75 static int modparam_hwpctl;
76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79 static int modparam_nohwcrypt;
80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83 static int modparam_qos = 1;
84 module_param_named(qos, modparam_qos, int, 0444);
85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87 static int modparam_btcoex = 1;
88 module_param_named(btcoex, modparam_btcoex, int, 0444);
89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
94
95
96 static const struct ssb_device_id b43_ssb_tbl[] = {
97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
106         SSB_DEVTABLE_END
107 };
108
109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
110
111 /* Channel and ratetables are shared for all devices.
112  * They can't be const, because ieee80211 puts some precalculated
113  * data in there. This data is the same for all devices, so we don't
114  * get concurrency issues */
115 #define RATETAB_ENT(_rateid, _flags) \
116         {                                                               \
117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
118                 .hw_value       = (_rateid),                            \
119                 .flags          = (_flags),                             \
120         }
121
122 /*
123  * NOTE: When changing this, sync with xmit.c's
124  *       b43_plcp_get_bitrate_idx_* functions!
125  */
126 static struct ieee80211_rate __b43_ratetable[] = {
127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
139 };
140
141 #define b43_a_ratetable         (__b43_ratetable + 4)
142 #define b43_a_ratetable_size    8
143 #define b43_b_ratetable         (__b43_ratetable + 0)
144 #define b43_b_ratetable_size    4
145 #define b43_g_ratetable         (__b43_ratetable + 0)
146 #define b43_g_ratetable_size    12
147
148 #define CHAN4G(_channel, _freq, _flags) {                       \
149         .band                   = IEEE80211_BAND_2GHZ,          \
150         .center_freq            = (_freq),                      \
151         .hw_value               = (_channel),                   \
152         .flags                  = (_flags),                     \
153         .max_antenna_gain       = 0,                            \
154         .max_power              = 30,                           \
155 }
156 static struct ieee80211_channel b43_2ghz_chantable[] = {
157         CHAN4G(1, 2412, 0),
158         CHAN4G(2, 2417, 0),
159         CHAN4G(3, 2422, 0),
160         CHAN4G(4, 2427, 0),
161         CHAN4G(5, 2432, 0),
162         CHAN4G(6, 2437, 0),
163         CHAN4G(7, 2442, 0),
164         CHAN4G(8, 2447, 0),
165         CHAN4G(9, 2452, 0),
166         CHAN4G(10, 2457, 0),
167         CHAN4G(11, 2462, 0),
168         CHAN4G(12, 2467, 0),
169         CHAN4G(13, 2472, 0),
170         CHAN4G(14, 2484, 0),
171 };
172 #undef CHAN4G
173
174 #define CHAN5G(_channel, _flags) {                              \
175         .band                   = IEEE80211_BAND_5GHZ,          \
176         .center_freq            = 5000 + (5 * (_channel)),      \
177         .hw_value               = (_channel),                   \
178         .flags                  = (_flags),                     \
179         .max_antenna_gain       = 0,                            \
180         .max_power              = 30,                           \
181 }
182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
183         CHAN5G(32, 0),          CHAN5G(34, 0),
184         CHAN5G(36, 0),          CHAN5G(38, 0),
185         CHAN5G(40, 0),          CHAN5G(42, 0),
186         CHAN5G(44, 0),          CHAN5G(46, 0),
187         CHAN5G(48, 0),          CHAN5G(50, 0),
188         CHAN5G(52, 0),          CHAN5G(54, 0),
189         CHAN5G(56, 0),          CHAN5G(58, 0),
190         CHAN5G(60, 0),          CHAN5G(62, 0),
191         CHAN5G(64, 0),          CHAN5G(66, 0),
192         CHAN5G(68, 0),          CHAN5G(70, 0),
193         CHAN5G(72, 0),          CHAN5G(74, 0),
194         CHAN5G(76, 0),          CHAN5G(78, 0),
195         CHAN5G(80, 0),          CHAN5G(82, 0),
196         CHAN5G(84, 0),          CHAN5G(86, 0),
197         CHAN5G(88, 0),          CHAN5G(90, 0),
198         CHAN5G(92, 0),          CHAN5G(94, 0),
199         CHAN5G(96, 0),          CHAN5G(98, 0),
200         CHAN5G(100, 0),         CHAN5G(102, 0),
201         CHAN5G(104, 0),         CHAN5G(106, 0),
202         CHAN5G(108, 0),         CHAN5G(110, 0),
203         CHAN5G(112, 0),         CHAN5G(114, 0),
204         CHAN5G(116, 0),         CHAN5G(118, 0),
205         CHAN5G(120, 0),         CHAN5G(122, 0),
206         CHAN5G(124, 0),         CHAN5G(126, 0),
207         CHAN5G(128, 0),         CHAN5G(130, 0),
208         CHAN5G(132, 0),         CHAN5G(134, 0),
209         CHAN5G(136, 0),         CHAN5G(138, 0),
210         CHAN5G(140, 0),         CHAN5G(142, 0),
211         CHAN5G(144, 0),         CHAN5G(145, 0),
212         CHAN5G(146, 0),         CHAN5G(147, 0),
213         CHAN5G(148, 0),         CHAN5G(149, 0),
214         CHAN5G(150, 0),         CHAN5G(151, 0),
215         CHAN5G(152, 0),         CHAN5G(153, 0),
216         CHAN5G(154, 0),         CHAN5G(155, 0),
217         CHAN5G(156, 0),         CHAN5G(157, 0),
218         CHAN5G(158, 0),         CHAN5G(159, 0),
219         CHAN5G(160, 0),         CHAN5G(161, 0),
220         CHAN5G(162, 0),         CHAN5G(163, 0),
221         CHAN5G(164, 0),         CHAN5G(165, 0),
222         CHAN5G(166, 0),         CHAN5G(168, 0),
223         CHAN5G(170, 0),         CHAN5G(172, 0),
224         CHAN5G(174, 0),         CHAN5G(176, 0),
225         CHAN5G(178, 0),         CHAN5G(180, 0),
226         CHAN5G(182, 0),         CHAN5G(184, 0),
227         CHAN5G(186, 0),         CHAN5G(188, 0),
228         CHAN5G(190, 0),         CHAN5G(192, 0),
229         CHAN5G(194, 0),         CHAN5G(196, 0),
230         CHAN5G(198, 0),         CHAN5G(200, 0),
231         CHAN5G(202, 0),         CHAN5G(204, 0),
232         CHAN5G(206, 0),         CHAN5G(208, 0),
233         CHAN5G(210, 0),         CHAN5G(212, 0),
234         CHAN5G(214, 0),         CHAN5G(216, 0),
235         CHAN5G(218, 0),         CHAN5G(220, 0),
236         CHAN5G(222, 0),         CHAN5G(224, 0),
237         CHAN5G(226, 0),         CHAN5G(228, 0),
238 };
239
240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
241         CHAN5G(34, 0),          CHAN5G(36, 0),
242         CHAN5G(38, 0),          CHAN5G(40, 0),
243         CHAN5G(42, 0),          CHAN5G(44, 0),
244         CHAN5G(46, 0),          CHAN5G(48, 0),
245         CHAN5G(52, 0),          CHAN5G(56, 0),
246         CHAN5G(60, 0),          CHAN5G(64, 0),
247         CHAN5G(100, 0),         CHAN5G(104, 0),
248         CHAN5G(108, 0),         CHAN5G(112, 0),
249         CHAN5G(116, 0),         CHAN5G(120, 0),
250         CHAN5G(124, 0),         CHAN5G(128, 0),
251         CHAN5G(132, 0),         CHAN5G(136, 0),
252         CHAN5G(140, 0),         CHAN5G(149, 0),
253         CHAN5G(153, 0),         CHAN5G(157, 0),
254         CHAN5G(161, 0),         CHAN5G(165, 0),
255         CHAN5G(184, 0),         CHAN5G(188, 0),
256         CHAN5G(192, 0),         CHAN5G(196, 0),
257         CHAN5G(200, 0),         CHAN5G(204, 0),
258         CHAN5G(208, 0),         CHAN5G(212, 0),
259         CHAN5G(216, 0),
260 };
261 #undef CHAN5G
262
263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
264         .band           = IEEE80211_BAND_5GHZ,
265         .channels       = b43_5ghz_nphy_chantable,
266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
267         .bitrates       = b43_a_ratetable,
268         .n_bitrates     = b43_a_ratetable_size,
269 };
270
271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
272         .band           = IEEE80211_BAND_5GHZ,
273         .channels       = b43_5ghz_aphy_chantable,
274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
275         .bitrates       = b43_a_ratetable,
276         .n_bitrates     = b43_a_ratetable_size,
277 };
278
279 static struct ieee80211_supported_band b43_band_2GHz = {
280         .band           = IEEE80211_BAND_2GHZ,
281         .channels       = b43_2ghz_chantable,
282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
283         .bitrates       = b43_g_ratetable,
284         .n_bitrates     = b43_g_ratetable_size,
285 };
286
287 static void b43_wireless_core_exit(struct b43_wldev *dev);
288 static int b43_wireless_core_init(struct b43_wldev *dev);
289 static void b43_wireless_core_stop(struct b43_wldev *dev);
290 static int b43_wireless_core_start(struct b43_wldev *dev);
291
292 static int b43_ratelimit(struct b43_wl *wl)
293 {
294         if (!wl || !wl->current_dev)
295                 return 1;
296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
297                 return 1;
298         /* We are up and running.
299          * Ratelimit the messages to avoid DoS over the net. */
300         return net_ratelimit();
301 }
302
303 void b43info(struct b43_wl *wl, const char *fmt, ...)
304 {
305         va_list args;
306
307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
308                 return;
309         if (!b43_ratelimit(wl))
310                 return;
311         va_start(args, fmt);
312         printk(KERN_INFO "b43-%s: ",
313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
314         vprintk(fmt, args);
315         va_end(args);
316 }
317
318 void b43err(struct b43_wl *wl, const char *fmt, ...)
319 {
320         va_list args;
321
322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
323                 return;
324         if (!b43_ratelimit(wl))
325                 return;
326         va_start(args, fmt);
327         printk(KERN_ERR "b43-%s ERROR: ",
328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
329         vprintk(fmt, args);
330         va_end(args);
331 }
332
333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
334 {
335         va_list args;
336
337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
338                 return;
339         if (!b43_ratelimit(wl))
340                 return;
341         va_start(args, fmt);
342         printk(KERN_WARNING "b43-%s warning: ",
343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344         vprintk(fmt, args);
345         va_end(args);
346 }
347
348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
349 {
350         va_list args;
351
352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
353                 return;
354         va_start(args, fmt);
355         printk(KERN_DEBUG "b43-%s debug: ",
356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
357         vprintk(fmt, args);
358         va_end(args);
359 }
360
361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
362 {
363         u32 macctl;
364
365         B43_WARN_ON(offset % 4 != 0);
366
367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
368         if (macctl & B43_MACCTL_BE)
369                 val = swab32(val);
370
371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
372         mmiowb();
373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
374 }
375
376 static inline void b43_shm_control_word(struct b43_wldev *dev,
377                                         u16 routing, u16 offset)
378 {
379         u32 control;
380
381         /* "offset" is the WORD offset. */
382         control = routing;
383         control <<= 16;
384         control |= offset;
385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
386 }
387
388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
389 {
390         u32 ret;
391
392         if (routing == B43_SHM_SHARED) {
393                 B43_WARN_ON(offset & 0x0001);
394                 if (offset & 0x0003) {
395                         /* Unaligned access */
396                         b43_shm_control_word(dev, routing, offset >> 2);
397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
398                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
399                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
400
401                         goto out;
402                 }
403                 offset >>= 2;
404         }
405         b43_shm_control_word(dev, routing, offset);
406         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
407 out:
408         return ret;
409 }
410
411 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
412 {
413         struct b43_wl *wl = dev->wl;
414         unsigned long flags;
415         u32 ret;
416
417         spin_lock_irqsave(&wl->shm_lock, flags);
418         ret = __b43_shm_read32(dev, routing, offset);
419         spin_unlock_irqrestore(&wl->shm_lock, flags);
420
421         return ret;
422 }
423
424 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
425 {
426         u16 ret;
427
428         if (routing == B43_SHM_SHARED) {
429                 B43_WARN_ON(offset & 0x0001);
430                 if (offset & 0x0003) {
431                         /* Unaligned access */
432                         b43_shm_control_word(dev, routing, offset >> 2);
433                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
434
435                         goto out;
436                 }
437                 offset >>= 2;
438         }
439         b43_shm_control_word(dev, routing, offset);
440         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
441 out:
442         return ret;
443 }
444
445 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
446 {
447         struct b43_wl *wl = dev->wl;
448         unsigned long flags;
449         u16 ret;
450
451         spin_lock_irqsave(&wl->shm_lock, flags);
452         ret = __b43_shm_read16(dev, routing, offset);
453         spin_unlock_irqrestore(&wl->shm_lock, flags);
454
455         return ret;
456 }
457
458 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
459 {
460         if (routing == B43_SHM_SHARED) {
461                 B43_WARN_ON(offset & 0x0001);
462                 if (offset & 0x0003) {
463                         /* Unaligned access */
464                         b43_shm_control_word(dev, routing, offset >> 2);
465                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
466                                     value & 0xFFFF);
467                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
468                         b43_write16(dev, B43_MMIO_SHM_DATA,
469                                     (value >> 16) & 0xFFFF);
470                         return;
471                 }
472                 offset >>= 2;
473         }
474         b43_shm_control_word(dev, routing, offset);
475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
476 }
477
478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
479 {
480         struct b43_wl *wl = dev->wl;
481         unsigned long flags;
482
483         spin_lock_irqsave(&wl->shm_lock, flags);
484         __b43_shm_write32(dev, routing, offset, value);
485         spin_unlock_irqrestore(&wl->shm_lock, flags);
486 }
487
488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
489 {
490         if (routing == B43_SHM_SHARED) {
491                 B43_WARN_ON(offset & 0x0001);
492                 if (offset & 0x0003) {
493                         /* Unaligned access */
494                         b43_shm_control_word(dev, routing, offset >> 2);
495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
496                         return;
497                 }
498                 offset >>= 2;
499         }
500         b43_shm_control_word(dev, routing, offset);
501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
502 }
503
504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
505 {
506         struct b43_wl *wl = dev->wl;
507         unsigned long flags;
508
509         spin_lock_irqsave(&wl->shm_lock, flags);
510         __b43_shm_write16(dev, routing, offset, value);
511         spin_unlock_irqrestore(&wl->shm_lock, flags);
512 }
513
514 /* Read HostFlags */
515 u64 b43_hf_read(struct b43_wldev *dev)
516 {
517         u64 ret;
518
519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
520         ret <<= 16;
521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
522         ret <<= 16;
523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
524
525         return ret;
526 }
527
528 /* Write HostFlags */
529 void b43_hf_write(struct b43_wldev *dev, u64 value)
530 {
531         u16 lo, mi, hi;
532
533         lo = (value & 0x00000000FFFFULL);
534         mi = (value & 0x0000FFFF0000ULL) >> 16;
535         hi = (value & 0xFFFF00000000ULL) >> 32;
536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
539 }
540
541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
543 {
544         B43_WARN_ON(!dev->fw.opensource);
545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
546 }
547
548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
549 {
550         u32 low, high;
551
552         B43_WARN_ON(dev->dev->id.revision < 3);
553
554         /* The hardware guarantees us an atomic read, if we
555          * read the low register first. */
556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
558
559         *tsf = high;
560         *tsf <<= 32;
561         *tsf |= low;
562 }
563
564 static void b43_time_lock(struct b43_wldev *dev)
565 {
566         u32 macctl;
567
568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
569         macctl |= B43_MACCTL_TBTTHOLD;
570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
571         /* Commit the write */
572         b43_read32(dev, B43_MMIO_MACCTL);
573 }
574
575 static void b43_time_unlock(struct b43_wldev *dev)
576 {
577         u32 macctl;
578
579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
580         macctl &= ~B43_MACCTL_TBTTHOLD;
581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
582         /* Commit the write */
583         b43_read32(dev, B43_MMIO_MACCTL);
584 }
585
586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
587 {
588         u32 low, high;
589
590         B43_WARN_ON(dev->dev->id.revision < 3);
591
592         low = tsf;
593         high = (tsf >> 32);
594         /* The hardware guarantees us an atomic write, if we
595          * write the low register first. */
596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
597         mmiowb();
598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
599         mmiowb();
600 }
601
602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
603 {
604         b43_time_lock(dev);
605         b43_tsf_write_locked(dev, tsf);
606         b43_time_unlock(dev);
607 }
608
609 static
610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
611 {
612         static const u8 zero_addr[ETH_ALEN] = { 0 };
613         u16 data;
614
615         if (!mac)
616                 mac = zero_addr;
617
618         offset |= 0x0020;
619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
620
621         data = mac[0];
622         data |= mac[1] << 8;
623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
624         data = mac[2];
625         data |= mac[3] << 8;
626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
627         data = mac[4];
628         data |= mac[5] << 8;
629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
630 }
631
632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
633 {
634         const u8 *mac;
635         const u8 *bssid;
636         u8 mac_bssid[ETH_ALEN * 2];
637         int i;
638         u32 tmp;
639
640         bssid = dev->wl->bssid;
641         mac = dev->wl->mac_addr;
642
643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
644
645         memcpy(mac_bssid, mac, ETH_ALEN);
646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
647
648         /* Write our MAC address and BSSID to template ram */
649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
650                 tmp = (u32) (mac_bssid[i + 0]);
651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
654                 b43_ram_write(dev, 0x20 + i, tmp);
655         }
656 }
657
658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
659 {
660         b43_write_mac_bssid_templates(dev);
661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
662 }
663
664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
665 {
666         /* slot_time is in usec. */
667         if (dev->phy.type != B43_PHYTYPE_G)
668                 return;
669         b43_write16(dev, 0x684, 510 + slot_time);
670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
671 }
672
673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
674 {
675         b43_set_slot_time(dev, 9);
676 }
677
678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
679 {
680         b43_set_slot_time(dev, 20);
681 }
682
683 /* Synchronize IRQ top- and bottom-half.
684  * IRQs must be masked before calling this.
685  * This must not be called with the irq_lock held.
686  */
687 static void b43_synchronize_irq(struct b43_wldev *dev)
688 {
689         synchronize_irq(dev->dev->irq);
690         tasklet_kill(&dev->isr_tasklet);
691 }
692
693 /* DummyTransmission function, as documented on
694  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
695  */
696 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
697 {
698         struct b43_wl *wl = dev->wl;
699         struct b43_phy *phy = &dev->phy;
700         unsigned int i, max_loop;
701         u16 value;
702         u32 buffer[5] = {
703                 0x00000000,
704                 0x00D40000,
705                 0x00000000,
706                 0x01000000,
707                 0x00000000,
708         };
709
710         if (ofdm) {
711                 max_loop = 0x1E;
712                 buffer[0] = 0x000201CC;
713         } else {
714                 max_loop = 0xFA;
715                 buffer[0] = 0x000B846E;
716         }
717
718         spin_lock_irq(&wl->irq_lock);
719         write_lock(&wl->tx_lock);
720
721         for (i = 0; i < 5; i++)
722                 b43_ram_write(dev, i * 4, buffer[i]);
723
724         b43_write16(dev, 0x0568, 0x0000);
725         if (dev->dev->id.revision < 11)
726                 b43_write16(dev, 0x07C0, 0x0000);
727         else
728                 b43_write16(dev, 0x07C0, 0x0100);
729         value = (ofdm ? 0x41 : 0x40);
730         b43_write16(dev, 0x050C, value);
731         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
732                 b43_write16(dev, 0x0514, 0x1A02);
733         b43_write16(dev, 0x0508, 0x0000);
734         b43_write16(dev, 0x050A, 0x0000);
735         b43_write16(dev, 0x054C, 0x0000);
736         b43_write16(dev, 0x056A, 0x0014);
737         b43_write16(dev, 0x0568, 0x0826);
738         b43_write16(dev, 0x0500, 0x0000);
739         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
740                 //SPEC TODO
741         }
742
743         switch (phy->type) {
744         case B43_PHYTYPE_N:
745                 b43_write16(dev, 0x0502, 0x00D0);
746                 break;
747         case B43_PHYTYPE_LP:
748                 b43_write16(dev, 0x0502, 0x0050);
749                 break;
750         default:
751                 b43_write16(dev, 0x0502, 0x0030);
752         }
753
754         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
755                 b43_radio_write16(dev, 0x0051, 0x0017);
756         for (i = 0x00; i < max_loop; i++) {
757                 value = b43_read16(dev, 0x050E);
758                 if (value & 0x0080)
759                         break;
760                 udelay(10);
761         }
762         for (i = 0x00; i < 0x0A; i++) {
763                 value = b43_read16(dev, 0x050E);
764                 if (value & 0x0400)
765                         break;
766                 udelay(10);
767         }
768         for (i = 0x00; i < 0x19; i++) {
769                 value = b43_read16(dev, 0x0690);
770                 if (!(value & 0x0100))
771                         break;
772                 udelay(10);
773         }
774         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
775                 b43_radio_write16(dev, 0x0051, 0x0037);
776
777         write_unlock(&wl->tx_lock);
778         spin_unlock_irq(&wl->irq_lock);
779 }
780
781 static void key_write(struct b43_wldev *dev,
782                       u8 index, u8 algorithm, const u8 *key)
783 {
784         unsigned int i;
785         u32 offset;
786         u16 value;
787         u16 kidx;
788
789         /* Key index/algo block */
790         kidx = b43_kidx_to_fw(dev, index);
791         value = ((kidx << 4) | algorithm);
792         b43_shm_write16(dev, B43_SHM_SHARED,
793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
794
795         /* Write the key to the Key Table Pointer offset */
796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
798                 value = key[i];
799                 value |= (u16) (key[i + 1]) << 8;
800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
801         }
802 }
803
804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
805 {
806         u32 addrtmp[2] = { 0, 0, };
807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
808
809         if (b43_new_kidx_api(dev))
810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
811
812         B43_WARN_ON(index < pairwise_keys_start);
813         /* We have four default TX keys and possibly four default RX keys.
814          * Physical mac 0 is mapped to physical key 4 or 8, depending
815          * on the firmware version.
816          * So we must adjust the index here.
817          */
818         index -= pairwise_keys_start;
819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
820
821         if (addr) {
822                 addrtmp[0] = addr[0];
823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
826                 addrtmp[1] = addr[4];
827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
828         }
829
830         /* Receive match transmitter address (RCMTA) mechanism */
831         b43_shm_write32(dev, B43_SHM_RCMTA,
832                         (index * 2) + 0, addrtmp[0]);
833         b43_shm_write16(dev, B43_SHM_RCMTA,
834                         (index * 2) + 1, addrtmp[1]);
835 }
836
837 static void do_key_write(struct b43_wldev *dev,
838                          u8 index, u8 algorithm,
839                          const u8 *key, size_t key_len, const u8 *mac_addr)
840 {
841         u8 buf[B43_SEC_KEYSIZE] = { 0, };
842         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
843
844         if (b43_new_kidx_api(dev))
845                 pairwise_keys_start = B43_NR_GROUP_KEYS;
846
847         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
848         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
849
850         if (index >= pairwise_keys_start)
851                 keymac_write(dev, index, NULL); /* First zero out mac. */
852         if (key)
853                 memcpy(buf, key, key_len);
854         key_write(dev, index, algorithm, buf);
855         if (index >= pairwise_keys_start)
856                 keymac_write(dev, index, mac_addr);
857
858         dev->key[index].algorithm = algorithm;
859 }
860
861 static int b43_key_write(struct b43_wldev *dev,
862                          int index, u8 algorithm,
863                          const u8 *key, size_t key_len,
864                          const u8 *mac_addr,
865                          struct ieee80211_key_conf *keyconf)
866 {
867         int i;
868         int pairwise_keys_start;
869
870         if (key_len > B43_SEC_KEYSIZE)
871                 return -EINVAL;
872         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
873                 /* Check that we don't already have this key. */
874                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
875         }
876         if (index < 0) {
877                 /* Pairwise key. Get an empty slot for the key. */
878                 if (b43_new_kidx_api(dev))
879                         pairwise_keys_start = B43_NR_GROUP_KEYS;
880                 else
881                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
882                 for (i = pairwise_keys_start;
883                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
884                      i++) {
885                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
886                         if (!dev->key[i].keyconf) {
887                                 /* found empty */
888                                 index = i;
889                                 break;
890                         }
891                 }
892                 if (index < 0) {
893                         b43warn(dev->wl, "Out of hardware key memory\n");
894                         return -ENOSPC;
895                 }
896         } else
897                 B43_WARN_ON(index > 3);
898
899         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
900         if ((index <= 3) && !b43_new_kidx_api(dev)) {
901                 /* Default RX key */
902                 B43_WARN_ON(mac_addr);
903                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
904         }
905         keyconf->hw_key_idx = index;
906         dev->key[index].keyconf = keyconf;
907
908         return 0;
909 }
910
911 static int b43_key_clear(struct b43_wldev *dev, int index)
912 {
913         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
914                 return -EINVAL;
915         do_key_write(dev, index, B43_SEC_ALGO_NONE,
916                      NULL, B43_SEC_KEYSIZE, NULL);
917         if ((index <= 3) && !b43_new_kidx_api(dev)) {
918                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
919                              NULL, B43_SEC_KEYSIZE, NULL);
920         }
921         dev->key[index].keyconf = NULL;
922
923         return 0;
924 }
925
926 static void b43_clear_keys(struct b43_wldev *dev)
927 {
928         int i, count;
929
930         if (b43_new_kidx_api(dev))
931                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
932         else
933                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
934         for (i = 0; i < count; i++)
935                 b43_key_clear(dev, i);
936 }
937
938 static void b43_dump_keymemory(struct b43_wldev *dev)
939 {
940         unsigned int i, index, count, offset, pairwise_keys_start;
941         u8 mac[ETH_ALEN];
942         u16 algo;
943         u32 rcmta0;
944         u16 rcmta1;
945         u64 hf;
946         struct b43_key *key;
947
948         if (!b43_debug(dev, B43_DBG_KEYS))
949                 return;
950
951         hf = b43_hf_read(dev);
952         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
953                !!(hf & B43_HF_USEDEFKEYS));
954         if (b43_new_kidx_api(dev)) {
955                 pairwise_keys_start = B43_NR_GROUP_KEYS;
956                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
957         } else {
958                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
959                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
960         }
961         for (index = 0; index < count; index++) {
962                 key = &(dev->key[index]);
963                 printk(KERN_DEBUG "Key slot %02u: %s",
964                        index, (key->keyconf == NULL) ? " " : "*");
965                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
966                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
967                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
968                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
969                 }
970
971                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
972                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
973                 printk("   Algo: %04X/%02X", algo, key->algorithm);
974
975                 if (index >= pairwise_keys_start) {
976                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
977                                                 ((index - pairwise_keys_start) * 2) + 0);
978                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
979                                                 ((index - pairwise_keys_start) * 2) + 1);
980                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
981                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
982                         printk("   MAC: %pM", mac);
983                 } else
984                         printk("   DEFAULT KEY");
985                 printk("\n");
986         }
987 }
988
989 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
990 {
991         u32 macctl;
992         u16 ucstat;
993         bool hwps;
994         bool awake;
995         int i;
996
997         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
998                     (ps_flags & B43_PS_DISABLED));
999         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1000
1001         if (ps_flags & B43_PS_ENABLED) {
1002                 hwps = 1;
1003         } else if (ps_flags & B43_PS_DISABLED) {
1004                 hwps = 0;
1005         } else {
1006                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1007                 //      and thus is not an AP and we are associated, set bit 25
1008         }
1009         if (ps_flags & B43_PS_AWAKE) {
1010                 awake = 1;
1011         } else if (ps_flags & B43_PS_ASLEEP) {
1012                 awake = 0;
1013         } else {
1014                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1015                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1016                 //      successful, set bit26
1017         }
1018
1019 /* FIXME: For now we force awake-on and hwps-off */
1020         hwps = 0;
1021         awake = 1;
1022
1023         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1024         if (hwps)
1025                 macctl |= B43_MACCTL_HWPS;
1026         else
1027                 macctl &= ~B43_MACCTL_HWPS;
1028         if (awake)
1029                 macctl |= B43_MACCTL_AWAKE;
1030         else
1031                 macctl &= ~B43_MACCTL_AWAKE;
1032         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1033         /* Commit write */
1034         b43_read32(dev, B43_MMIO_MACCTL);
1035         if (awake && dev->dev->id.revision >= 5) {
1036                 /* Wait for the microcode to wake up. */
1037                 for (i = 0; i < 100; i++) {
1038                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                                 B43_SHM_SH_UCODESTAT);
1040                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1041                                 break;
1042                         udelay(10);
1043                 }
1044         }
1045 }
1046
1047 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1048 {
1049         u32 tmslow;
1050         u32 macctl;
1051
1052         flags |= B43_TMSLOW_PHYCLKEN;
1053         flags |= B43_TMSLOW_PHYRESET;
1054         ssb_device_enable(dev->dev, flags);
1055         msleep(2);              /* Wait for the PLL to turn on. */
1056
1057         /* Now take the PHY out of Reset again */
1058         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1059         tmslow |= SSB_TMSLOW_FGC;
1060         tmslow &= ~B43_TMSLOW_PHYRESET;
1061         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1062         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1063         msleep(1);
1064         tmslow &= ~SSB_TMSLOW_FGC;
1065         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1066         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1067         msleep(1);
1068
1069         /* Turn Analog ON, but only if we already know the PHY-type.
1070          * This protects against very early setup where we don't know the
1071          * PHY-type, yet. wireless_core_reset will be called once again later,
1072          * when we know the PHY-type. */
1073         if (dev->phy.ops)
1074                 dev->phy.ops->switch_analog(dev, 1);
1075
1076         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1077         macctl &= ~B43_MACCTL_GMODE;
1078         if (flags & B43_TMSLOW_GMODE)
1079                 macctl |= B43_MACCTL_GMODE;
1080         macctl |= B43_MACCTL_IHR_ENABLED;
1081         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1082 }
1083
1084 static void handle_irq_transmit_status(struct b43_wldev *dev)
1085 {
1086         u32 v0, v1;
1087         u16 tmp;
1088         struct b43_txstatus stat;
1089
1090         while (1) {
1091                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1092                 if (!(v0 & 0x00000001))
1093                         break;
1094                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1095
1096                 stat.cookie = (v0 >> 16);
1097                 stat.seq = (v1 & 0x0000FFFF);
1098                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1099                 tmp = (v0 & 0x0000FFFF);
1100                 stat.frame_count = ((tmp & 0xF000) >> 12);
1101                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1102                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1103                 stat.pm_indicated = !!(tmp & 0x0080);
1104                 stat.intermediate = !!(tmp & 0x0040);
1105                 stat.for_ampdu = !!(tmp & 0x0020);
1106                 stat.acked = !!(tmp & 0x0002);
1107
1108                 b43_handle_txstatus(dev, &stat);
1109         }
1110 }
1111
1112 static void drain_txstatus_queue(struct b43_wldev *dev)
1113 {
1114         u32 dummy;
1115
1116         if (dev->dev->id.revision < 5)
1117                 return;
1118         /* Read all entries from the microcode TXstatus FIFO
1119          * and throw them away.
1120          */
1121         while (1) {
1122                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1123                 if (!(dummy & 0x00000001))
1124                         break;
1125                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1126         }
1127 }
1128
1129 static u32 b43_jssi_read(struct b43_wldev *dev)
1130 {
1131         u32 val = 0;
1132
1133         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1134         val <<= 16;
1135         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1136
1137         return val;
1138 }
1139
1140 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1141 {
1142         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1143         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1144 }
1145
1146 static void b43_generate_noise_sample(struct b43_wldev *dev)
1147 {
1148         b43_jssi_write(dev, 0x7F7F7F7F);
1149         b43_write32(dev, B43_MMIO_MACCMD,
1150                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1151 }
1152
1153 static void b43_calculate_link_quality(struct b43_wldev *dev)
1154 {
1155         /* Top half of Link Quality calculation. */
1156
1157         if (dev->phy.type != B43_PHYTYPE_G)
1158                 return;
1159         if (dev->noisecalc.calculation_running)
1160                 return;
1161         dev->noisecalc.calculation_running = 1;
1162         dev->noisecalc.nr_samples = 0;
1163
1164         b43_generate_noise_sample(dev);
1165 }
1166
1167 static void handle_irq_noise(struct b43_wldev *dev)
1168 {
1169         struct b43_phy_g *phy = dev->phy.g;
1170         u16 tmp;
1171         u8 noise[4];
1172         u8 i, j;
1173         s32 average;
1174
1175         /* Bottom half of Link Quality calculation. */
1176
1177         if (dev->phy.type != B43_PHYTYPE_G)
1178                 return;
1179
1180         /* Possible race condition: It might be possible that the user
1181          * changed to a different channel in the meantime since we
1182          * started the calculation. We ignore that fact, since it's
1183          * not really that much of a problem. The background noise is
1184          * an estimation only anyway. Slightly wrong results will get damped
1185          * by the averaging of the 8 sample rounds. Additionally the
1186          * value is shortlived. So it will be replaced by the next noise
1187          * calculation round soon. */
1188
1189         B43_WARN_ON(!dev->noisecalc.calculation_running);
1190         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1191         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1192             noise[2] == 0x7F || noise[3] == 0x7F)
1193                 goto generate_new;
1194
1195         /* Get the noise samples. */
1196         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1197         i = dev->noisecalc.nr_samples;
1198         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1199         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1200         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1203         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1204         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1205         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1206         dev->noisecalc.nr_samples++;
1207         if (dev->noisecalc.nr_samples == 8) {
1208                 /* Calculate the Link Quality by the noise samples. */
1209                 average = 0;
1210                 for (i = 0; i < 8; i++) {
1211                         for (j = 0; j < 4; j++)
1212                                 average += dev->noisecalc.samples[i][j];
1213                 }
1214                 average /= (8 * 4);
1215                 average *= 125;
1216                 average += 64;
1217                 average /= 128;
1218                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1219                 tmp = (tmp / 128) & 0x1F;
1220                 if (tmp >= 8)
1221                         average += 2;
1222                 else
1223                         average -= 25;
1224                 if (tmp == 8)
1225                         average -= 72;
1226                 else
1227                         average -= 48;
1228
1229                 dev->stats.link_noise = average;
1230                 dev->noisecalc.calculation_running = 0;
1231                 return;
1232         }
1233 generate_new:
1234         b43_generate_noise_sample(dev);
1235 }
1236
1237 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1238 {
1239         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1240                 ///TODO: PS TBTT
1241         } else {
1242                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1243                         b43_power_saving_ctl_bits(dev, 0);
1244         }
1245         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1246                 dev->dfq_valid = 1;
1247 }
1248
1249 static void handle_irq_atim_end(struct b43_wldev *dev)
1250 {
1251         if (dev->dfq_valid) {
1252                 b43_write32(dev, B43_MMIO_MACCMD,
1253                             b43_read32(dev, B43_MMIO_MACCMD)
1254                             | B43_MACCMD_DFQ_VALID);
1255                 dev->dfq_valid = 0;
1256         }
1257 }
1258
1259 static void handle_irq_pmq(struct b43_wldev *dev)
1260 {
1261         u32 tmp;
1262
1263         //TODO: AP mode.
1264
1265         while (1) {
1266                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1267                 if (!(tmp & 0x00000008))
1268                         break;
1269         }
1270         /* 16bit write is odd, but correct. */
1271         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1272 }
1273
1274 static void b43_write_template_common(struct b43_wldev *dev,
1275                                       const u8 *data, u16 size,
1276                                       u16 ram_offset,
1277                                       u16 shm_size_offset, u8 rate)
1278 {
1279         u32 i, tmp;
1280         struct b43_plcp_hdr4 plcp;
1281
1282         plcp.data = 0;
1283         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1284         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1285         ram_offset += sizeof(u32);
1286         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1287          * So leave the first two bytes of the next write blank.
1288          */
1289         tmp = (u32) (data[0]) << 16;
1290         tmp |= (u32) (data[1]) << 24;
1291         b43_ram_write(dev, ram_offset, tmp);
1292         ram_offset += sizeof(u32);
1293         for (i = 2; i < size; i += sizeof(u32)) {
1294                 tmp = (u32) (data[i + 0]);
1295                 if (i + 1 < size)
1296                         tmp |= (u32) (data[i + 1]) << 8;
1297                 if (i + 2 < size)
1298                         tmp |= (u32) (data[i + 2]) << 16;
1299                 if (i + 3 < size)
1300                         tmp |= (u32) (data[i + 3]) << 24;
1301                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1302         }
1303         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1304                         size + sizeof(struct b43_plcp_hdr6));
1305 }
1306
1307 /* Check if the use of the antenna that ieee80211 told us to
1308  * use is possible. This will fall back to DEFAULT.
1309  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1310 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1311                                   u8 antenna_nr)
1312 {
1313         u8 antenna_mask;
1314
1315         if (antenna_nr == 0) {
1316                 /* Zero means "use default antenna". That's always OK. */
1317                 return 0;
1318         }
1319
1320         /* Get the mask of available antennas. */
1321         if (dev->phy.gmode)
1322                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1323         else
1324                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1325
1326         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1327                 /* This antenna is not available. Fall back to default. */
1328                 return 0;
1329         }
1330
1331         return antenna_nr;
1332 }
1333
1334 /* Convert a b43 antenna number value to the PHY TX control value. */
1335 static u16 b43_antenna_to_phyctl(int antenna)
1336 {
1337         switch (antenna) {
1338         case B43_ANTENNA0:
1339                 return B43_TXH_PHY_ANT0;
1340         case B43_ANTENNA1:
1341                 return B43_TXH_PHY_ANT1;
1342         case B43_ANTENNA2:
1343                 return B43_TXH_PHY_ANT2;
1344         case B43_ANTENNA3:
1345                 return B43_TXH_PHY_ANT3;
1346         case B43_ANTENNA_AUTO:
1347                 return B43_TXH_PHY_ANT01AUTO;
1348         }
1349         B43_WARN_ON(1);
1350         return 0;
1351 }
1352
1353 static void b43_write_beacon_template(struct b43_wldev *dev,
1354                                       u16 ram_offset,
1355                                       u16 shm_size_offset)
1356 {
1357         unsigned int i, len, variable_len;
1358         const struct ieee80211_mgmt *bcn;
1359         const u8 *ie;
1360         bool tim_found = 0;
1361         unsigned int rate;
1362         u16 ctl;
1363         int antenna;
1364         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1365
1366         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1367         len = min((size_t) dev->wl->current_beacon->len,
1368                   0x200 - sizeof(struct b43_plcp_hdr6));
1369         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1370
1371         b43_write_template_common(dev, (const u8 *)bcn,
1372                                   len, ram_offset, shm_size_offset, rate);
1373
1374         /* Write the PHY TX control parameters. */
1375         antenna = B43_ANTENNA_DEFAULT;
1376         antenna = b43_antenna_to_phyctl(antenna);
1377         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1378         /* We can't send beacons with short preamble. Would get PHY errors. */
1379         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1380         ctl &= ~B43_TXH_PHY_ANT;
1381         ctl &= ~B43_TXH_PHY_ENC;
1382         ctl |= antenna;
1383         if (b43_is_cck_rate(rate))
1384                 ctl |= B43_TXH_PHY_ENC_CCK;
1385         else
1386                 ctl |= B43_TXH_PHY_ENC_OFDM;
1387         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1388
1389         /* Find the position of the TIM and the DTIM_period value
1390          * and write them to SHM. */
1391         ie = bcn->u.beacon.variable;
1392         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1393         for (i = 0; i < variable_len - 2; ) {
1394                 uint8_t ie_id, ie_len;
1395
1396                 ie_id = ie[i];
1397                 ie_len = ie[i + 1];
1398                 if (ie_id == 5) {
1399                         u16 tim_position;
1400                         u16 dtim_period;
1401                         /* This is the TIM Information Element */
1402
1403                         /* Check whether the ie_len is in the beacon data range. */
1404                         if (variable_len < ie_len + 2 + i)
1405                                 break;
1406                         /* A valid TIM is at least 4 bytes long. */
1407                         if (ie_len < 4)
1408                                 break;
1409                         tim_found = 1;
1410
1411                         tim_position = sizeof(struct b43_plcp_hdr6);
1412                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1413                         tim_position += i;
1414
1415                         dtim_period = ie[i + 3];
1416
1417                         b43_shm_write16(dev, B43_SHM_SHARED,
1418                                         B43_SHM_SH_TIMBPOS, tim_position);
1419                         b43_shm_write16(dev, B43_SHM_SHARED,
1420                                         B43_SHM_SH_DTIMPER, dtim_period);
1421                         break;
1422                 }
1423                 i += ie_len + 2;
1424         }
1425         if (!tim_found) {
1426                 /*
1427                  * If ucode wants to modify TIM do it behind the beacon, this
1428                  * will happen, for example, when doing mesh networking.
1429                  */
1430                 b43_shm_write16(dev, B43_SHM_SHARED,
1431                                 B43_SHM_SH_TIMBPOS,
1432                                 len + sizeof(struct b43_plcp_hdr6));
1433                 b43_shm_write16(dev, B43_SHM_SHARED,
1434                                 B43_SHM_SH_DTIMPER, 0);
1435         }
1436         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1437 }
1438
1439 static void b43_upload_beacon0(struct b43_wldev *dev)
1440 {
1441         struct b43_wl *wl = dev->wl;
1442
1443         if (wl->beacon0_uploaded)
1444                 return;
1445         b43_write_beacon_template(dev, 0x68, 0x18);
1446         wl->beacon0_uploaded = 1;
1447 }
1448
1449 static void b43_upload_beacon1(struct b43_wldev *dev)
1450 {
1451         struct b43_wl *wl = dev->wl;
1452
1453         if (wl->beacon1_uploaded)
1454                 return;
1455         b43_write_beacon_template(dev, 0x468, 0x1A);
1456         wl->beacon1_uploaded = 1;
1457 }
1458
1459 static void handle_irq_beacon(struct b43_wldev *dev)
1460 {
1461         struct b43_wl *wl = dev->wl;
1462         u32 cmd, beacon0_valid, beacon1_valid;
1463
1464         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1465             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1466                 return;
1467
1468         /* This is the bottom half of the asynchronous beacon update. */
1469
1470         /* Ignore interrupt in the future. */
1471         dev->irq_mask &= ~B43_IRQ_BEACON;
1472
1473         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1474         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1475         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1476
1477         /* Schedule interrupt manually, if busy. */
1478         if (beacon0_valid && beacon1_valid) {
1479                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1480                 dev->irq_mask |= B43_IRQ_BEACON;
1481                 return;
1482         }
1483
1484         if (unlikely(wl->beacon_templates_virgin)) {
1485                 /* We never uploaded a beacon before.
1486                  * Upload both templates now, but only mark one valid. */
1487                 wl->beacon_templates_virgin = 0;
1488                 b43_upload_beacon0(dev);
1489                 b43_upload_beacon1(dev);
1490                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1491                 cmd |= B43_MACCMD_BEACON0_VALID;
1492                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1493         } else {
1494                 if (!beacon0_valid) {
1495                         b43_upload_beacon0(dev);
1496                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1497                         cmd |= B43_MACCMD_BEACON0_VALID;
1498                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1499                 } else if (!beacon1_valid) {
1500                         b43_upload_beacon1(dev);
1501                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1502                         cmd |= B43_MACCMD_BEACON1_VALID;
1503                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1504                 }
1505         }
1506 }
1507
1508 static void b43_beacon_update_trigger_work(struct work_struct *work)
1509 {
1510         struct b43_wl *wl = container_of(work, struct b43_wl,
1511                                          beacon_update_trigger);
1512         struct b43_wldev *dev;
1513
1514         mutex_lock(&wl->mutex);
1515         dev = wl->current_dev;
1516         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1517                 spin_lock_irq(&wl->irq_lock);
1518                 /* update beacon right away or defer to irq */
1519                 handle_irq_beacon(dev);
1520                 /* The handler might have updated the IRQ mask. */
1521                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1522                 mmiowb();
1523                 spin_unlock_irq(&wl->irq_lock);
1524         }
1525         mutex_unlock(&wl->mutex);
1526 }
1527
1528 /* Asynchronously update the packet templates in template RAM.
1529  * Locking: Requires wl->irq_lock to be locked. */
1530 static void b43_update_templates(struct b43_wl *wl)
1531 {
1532         struct sk_buff *beacon;
1533
1534         /* This is the top half of the ansynchronous beacon update.
1535          * The bottom half is the beacon IRQ.
1536          * Beacon update must be asynchronous to avoid sending an
1537          * invalid beacon. This can happen for example, if the firmware
1538          * transmits a beacon while we are updating it. */
1539
1540         /* We could modify the existing beacon and set the aid bit in
1541          * the TIM field, but that would probably require resizing and
1542          * moving of data within the beacon template.
1543          * Simply request a new beacon and let mac80211 do the hard work. */
1544         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1545         if (unlikely(!beacon))
1546                 return;
1547
1548         if (wl->current_beacon)
1549                 dev_kfree_skb_any(wl->current_beacon);
1550         wl->current_beacon = beacon;
1551         wl->beacon0_uploaded = 0;
1552         wl->beacon1_uploaded = 0;
1553         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1554 }
1555
1556 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1557 {
1558         b43_time_lock(dev);
1559         if (dev->dev->id.revision >= 3) {
1560                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1561                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1562         } else {
1563                 b43_write16(dev, 0x606, (beacon_int >> 6));
1564                 b43_write16(dev, 0x610, beacon_int);
1565         }
1566         b43_time_unlock(dev);
1567         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1568 }
1569
1570 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1571 {
1572         u16 reason;
1573
1574         /* Read the register that contains the reason code for the panic. */
1575         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1576         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1577
1578         switch (reason) {
1579         default:
1580                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1581                 /* fallthrough */
1582         case B43_FWPANIC_DIE:
1583                 /* Do not restart the controller or firmware.
1584                  * The device is nonfunctional from now on.
1585                  * Restarting would result in this panic to trigger again,
1586                  * so we avoid that recursion. */
1587                 break;
1588         case B43_FWPANIC_RESTART:
1589                 b43_controller_restart(dev, "Microcode panic");
1590                 break;
1591         }
1592 }
1593
1594 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1595 {
1596         unsigned int i, cnt;
1597         u16 reason, marker_id, marker_line;
1598         __le16 *buf;
1599
1600         /* The proprietary firmware doesn't have this IRQ. */
1601         if (!dev->fw.opensource)
1602                 return;
1603
1604         /* Read the register that contains the reason code for this IRQ. */
1605         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1606
1607         switch (reason) {
1608         case B43_DEBUGIRQ_PANIC:
1609                 b43_handle_firmware_panic(dev);
1610                 break;
1611         case B43_DEBUGIRQ_DUMP_SHM:
1612                 if (!B43_DEBUG)
1613                         break; /* Only with driver debugging enabled. */
1614                 buf = kmalloc(4096, GFP_ATOMIC);
1615                 if (!buf) {
1616                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1617                         goto out;
1618                 }
1619                 for (i = 0; i < 4096; i += 2) {
1620                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1621                         buf[i / 2] = cpu_to_le16(tmp);
1622                 }
1623                 b43info(dev->wl, "Shared memory dump:\n");
1624                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1625                                16, 2, buf, 4096, 1);
1626                 kfree(buf);
1627                 break;
1628         case B43_DEBUGIRQ_DUMP_REGS:
1629                 if (!B43_DEBUG)
1630                         break; /* Only with driver debugging enabled. */
1631                 b43info(dev->wl, "Microcode register dump:\n");
1632                 for (i = 0, cnt = 0; i < 64; i++) {
1633                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1634                         if (cnt == 0)
1635                                 printk(KERN_INFO);
1636                         printk("r%02u: 0x%04X  ", i, tmp);
1637                         cnt++;
1638                         if (cnt == 6) {
1639                                 printk("\n");
1640                                 cnt = 0;
1641                         }
1642                 }
1643                 printk("\n");
1644                 break;
1645         case B43_DEBUGIRQ_MARKER:
1646                 if (!B43_DEBUG)
1647                         break; /* Only with driver debugging enabled. */
1648                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1649                                            B43_MARKER_ID_REG);
1650                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1651                                              B43_MARKER_LINE_REG);
1652                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1653                         "at line number %u\n",
1654                         marker_id, marker_line);
1655                 break;
1656         default:
1657                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1658                        reason);
1659         }
1660 out:
1661         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1662         b43_shm_write16(dev, B43_SHM_SCRATCH,
1663                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1664 }
1665
1666 /* Interrupt handler bottom-half */
1667 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1668 {
1669         u32 reason;
1670         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1671         u32 merged_dma_reason = 0;
1672         int i;
1673         unsigned long flags;
1674
1675         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1676
1677         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1678
1679         reason = dev->irq_reason;
1680         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1681                 dma_reason[i] = dev->dma_reason[i];
1682                 merged_dma_reason |= dma_reason[i];
1683         }
1684
1685         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1686                 b43err(dev->wl, "MAC transmission error\n");
1687
1688         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1689                 b43err(dev->wl, "PHY transmission error\n");
1690                 rmb();
1691                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1692                         atomic_set(&dev->phy.txerr_cnt,
1693                                    B43_PHY_TX_BADNESS_LIMIT);
1694                         b43err(dev->wl, "Too many PHY TX errors, "
1695                                         "restarting the controller\n");
1696                         b43_controller_restart(dev, "PHY TX errors");
1697                 }
1698         }
1699
1700         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1701                                           B43_DMAIRQ_NONFATALMASK))) {
1702                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1703                         b43err(dev->wl, "Fatal DMA error: "
1704                                "0x%08X, 0x%08X, 0x%08X, "
1705                                "0x%08X, 0x%08X, 0x%08X\n",
1706                                dma_reason[0], dma_reason[1],
1707                                dma_reason[2], dma_reason[3],
1708                                dma_reason[4], dma_reason[5]);
1709                         b43_controller_restart(dev, "DMA error");
1710                         mmiowb();
1711                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1712                         return;
1713                 }
1714                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1715                         b43err(dev->wl, "DMA error: "
1716                                "0x%08X, 0x%08X, 0x%08X, "
1717                                "0x%08X, 0x%08X, 0x%08X\n",
1718                                dma_reason[0], dma_reason[1],
1719                                dma_reason[2], dma_reason[3],
1720                                dma_reason[4], dma_reason[5]);
1721                 }
1722         }
1723
1724         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1725                 handle_irq_ucode_debug(dev);
1726         if (reason & B43_IRQ_TBTT_INDI)
1727                 handle_irq_tbtt_indication(dev);
1728         if (reason & B43_IRQ_ATIM_END)
1729                 handle_irq_atim_end(dev);
1730         if (reason & B43_IRQ_BEACON)
1731                 handle_irq_beacon(dev);
1732         if (reason & B43_IRQ_PMQ)
1733                 handle_irq_pmq(dev);
1734         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1735                 ;/* TODO */
1736         if (reason & B43_IRQ_NOISESAMPLE_OK)
1737                 handle_irq_noise(dev);
1738
1739         /* Check the DMA reason registers for received data. */
1740         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1741                 if (b43_using_pio_transfers(dev))
1742                         b43_pio_rx(dev->pio.rx_queue);
1743                 else
1744                         b43_dma_rx(dev->dma.rx_ring);
1745         }
1746         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1747         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1748         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1749         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1750         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1751
1752         if (reason & B43_IRQ_TX_OK)
1753                 handle_irq_transmit_status(dev);
1754
1755         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1756         mmiowb();
1757         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1758 }
1759
1760 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1761 {
1762         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1763
1764         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1765         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1766         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1767         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1768         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1769 /* Unused ring
1770         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1771 */
1772 }
1773
1774 /* Interrupt handler top-half */
1775 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1776 {
1777         irqreturn_t ret = IRQ_NONE;
1778         struct b43_wldev *dev = dev_id;
1779         u32 reason;
1780
1781         B43_WARN_ON(!dev);
1782
1783         spin_lock(&dev->wl->irq_lock);
1784
1785         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1786                 /* This can only happen on shared IRQ lines. */
1787                 goto out;
1788         }
1789         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1790         if (reason == 0xffffffff)       /* shared IRQ */
1791                 goto out;
1792         ret = IRQ_HANDLED;
1793         reason &= dev->irq_mask;
1794         if (!reason)
1795                 goto out;
1796
1797         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1798             & 0x0001DC00;
1799         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1800             & 0x0000DC00;
1801         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1802             & 0x0000DC00;
1803         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1804             & 0x0001DC00;
1805         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1806             & 0x0000DC00;
1807 /* Unused ring
1808         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1809             & 0x0000DC00;
1810 */
1811
1812         b43_interrupt_ack(dev, reason);
1813         /* disable all IRQs. They are enabled again in the bottom half. */
1814         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1815         /* save the reason code and call our bottom half. */
1816         dev->irq_reason = reason;
1817         tasklet_schedule(&dev->isr_tasklet);
1818 out:
1819         mmiowb();
1820         spin_unlock(&dev->wl->irq_lock);
1821
1822         return ret;
1823 }
1824
1825 void b43_do_release_fw(struct b43_firmware_file *fw)
1826 {
1827         release_firmware(fw->data);
1828         fw->data = NULL;
1829         fw->filename = NULL;
1830 }
1831
1832 static void b43_release_firmware(struct b43_wldev *dev)
1833 {
1834         b43_do_release_fw(&dev->fw.ucode);
1835         b43_do_release_fw(&dev->fw.pcm);
1836         b43_do_release_fw(&dev->fw.initvals);
1837         b43_do_release_fw(&dev->fw.initvals_band);
1838 }
1839
1840 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1841 {
1842         const char text[] =
1843                 "You must go to " \
1844                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1845                 "and download the correct firmware for this driver version. " \
1846                 "Please carefully read all instructions on this website.\n";
1847
1848         if (error)
1849                 b43err(wl, text);
1850         else
1851                 b43warn(wl, text);
1852 }
1853
1854 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1855                       const char *name,
1856                       struct b43_firmware_file *fw)
1857 {
1858         const struct firmware *blob;
1859         struct b43_fw_header *hdr;
1860         u32 size;
1861         int err;
1862
1863         if (!name) {
1864                 /* Don't fetch anything. Free possibly cached firmware. */
1865                 /* FIXME: We should probably keep it anyway, to save some headache
1866                  * on suspend/resume with multiband devices. */
1867                 b43_do_release_fw(fw);
1868                 return 0;
1869         }
1870         if (fw->filename) {
1871                 if ((fw->type == ctx->req_type) &&
1872                     (strcmp(fw->filename, name) == 0))
1873                         return 0; /* Already have this fw. */
1874                 /* Free the cached firmware first. */
1875                 /* FIXME: We should probably do this later after we successfully
1876                  * got the new fw. This could reduce headache with multiband devices.
1877                  * We could also redesign this to cache the firmware for all possible
1878                  * bands all the time. */
1879                 b43_do_release_fw(fw);
1880         }
1881
1882         switch (ctx->req_type) {
1883         case B43_FWTYPE_PROPRIETARY:
1884                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1885                          "b43%s/%s.fw",
1886                          modparam_fwpostfix, name);
1887                 break;
1888         case B43_FWTYPE_OPENSOURCE:
1889                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1890                          "b43-open%s/%s.fw",
1891                          modparam_fwpostfix, name);
1892                 break;
1893         default:
1894                 B43_WARN_ON(1);
1895                 return -ENOSYS;
1896         }
1897         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
1898         if (err == -ENOENT) {
1899                 snprintf(ctx->errors[ctx->req_type],
1900                          sizeof(ctx->errors[ctx->req_type]),
1901                          "Firmware file \"%s\" not found\n", ctx->fwname);
1902                 return err;
1903         } else if (err) {
1904                 snprintf(ctx->errors[ctx->req_type],
1905                          sizeof(ctx->errors[ctx->req_type]),
1906                          "Firmware file \"%s\" request failed (err=%d)\n",
1907                          ctx->fwname, err);
1908                 return err;
1909         }
1910         if (blob->size < sizeof(struct b43_fw_header))
1911                 goto err_format;
1912         hdr = (struct b43_fw_header *)(blob->data);
1913         switch (hdr->type) {
1914         case B43_FW_TYPE_UCODE:
1915         case B43_FW_TYPE_PCM:
1916                 size = be32_to_cpu(hdr->size);
1917                 if (size != blob->size - sizeof(struct b43_fw_header))
1918                         goto err_format;
1919                 /* fallthrough */
1920         case B43_FW_TYPE_IV:
1921                 if (hdr->ver != 1)
1922                         goto err_format;
1923                 break;
1924         default:
1925                 goto err_format;
1926         }
1927
1928         fw->data = blob;
1929         fw->filename = name;
1930         fw->type = ctx->req_type;
1931
1932         return 0;
1933
1934 err_format:
1935         snprintf(ctx->errors[ctx->req_type],
1936                  sizeof(ctx->errors[ctx->req_type]),
1937                  "Firmware file \"%s\" format error.\n", ctx->fwname);
1938         release_firmware(blob);
1939
1940         return -EPROTO;
1941 }
1942
1943 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
1944 {
1945         struct b43_wldev *dev = ctx->dev;
1946         struct b43_firmware *fw = &ctx->dev->fw;
1947         const u8 rev = ctx->dev->dev->id.revision;
1948         const char *filename;
1949         u32 tmshigh;
1950         int err;
1951
1952         /* Get microcode */
1953         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1954         if ((rev >= 5) && (rev <= 10))
1955                 filename = "ucode5";
1956         else if ((rev >= 11) && (rev <= 12))
1957                 filename = "ucode11";
1958         else if (rev == 13)
1959                 filename = "ucode13";
1960         else if (rev == 14)
1961                 filename = "ucode14";
1962         else if (rev >= 15)
1963                 filename = "ucode15";
1964         else
1965                 goto err_no_ucode;
1966         err = b43_do_request_fw(ctx, filename, &fw->ucode);
1967         if (err)
1968                 goto err_load;
1969
1970         /* Get PCM code */
1971         if ((rev >= 5) && (rev <= 10))
1972                 filename = "pcm5";
1973         else if (rev >= 11)
1974                 filename = NULL;
1975         else
1976                 goto err_no_pcm;
1977         fw->pcm_request_failed = 0;
1978         err = b43_do_request_fw(ctx, filename, &fw->pcm);
1979         if (err == -ENOENT) {
1980                 /* We did not find a PCM file? Not fatal, but
1981                  * core rev <= 10 must do without hwcrypto then. */
1982                 fw->pcm_request_failed = 1;
1983         } else if (err)
1984                 goto err_load;
1985
1986         /* Get initvals */
1987         switch (dev->phy.type) {
1988         case B43_PHYTYPE_A:
1989                 if ((rev >= 5) && (rev <= 10)) {
1990                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1991                                 filename = "a0g1initvals5";
1992                         else
1993                                 filename = "a0g0initvals5";
1994                 } else
1995                         goto err_no_initvals;
1996                 break;
1997         case B43_PHYTYPE_G:
1998                 if ((rev >= 5) && (rev <= 10))
1999                         filename = "b0g0initvals5";
2000                 else if (rev >= 13)
2001                         filename = "b0g0initvals13";
2002                 else
2003                         goto err_no_initvals;
2004                 break;
2005         case B43_PHYTYPE_N:
2006                 if ((rev >= 11) && (rev <= 12))
2007                         filename = "n0initvals11";
2008                 else
2009                         goto err_no_initvals;
2010                 break;
2011         case B43_PHYTYPE_LP:
2012                 if (rev == 13)
2013                         filename = "lp0initvals13";
2014                 else if (rev == 14)
2015                         filename = "lp0initvals14";
2016                 else if (rev >= 15)
2017                         filename = "lp0initvals15";
2018                 else
2019                         goto err_no_initvals;
2020                 break;
2021         default:
2022                 goto err_no_initvals;
2023         }
2024         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2025         if (err)
2026                 goto err_load;
2027
2028         /* Get bandswitch initvals */
2029         switch (dev->phy.type) {
2030         case B43_PHYTYPE_A:
2031                 if ((rev >= 5) && (rev <= 10)) {
2032                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2033                                 filename = "a0g1bsinitvals5";
2034                         else
2035                                 filename = "a0g0bsinitvals5";
2036                 } else if (rev >= 11)
2037                         filename = NULL;
2038                 else
2039                         goto err_no_initvals;
2040                 break;
2041         case B43_PHYTYPE_G:
2042                 if ((rev >= 5) && (rev <= 10))
2043                         filename = "b0g0bsinitvals5";
2044                 else if (rev >= 11)
2045                         filename = NULL;
2046                 else
2047                         goto err_no_initvals;
2048                 break;
2049         case B43_PHYTYPE_N:
2050                 if ((rev >= 11) && (rev <= 12))
2051                         filename = "n0bsinitvals11";
2052                 else
2053                         goto err_no_initvals;
2054                 break;
2055         case B43_PHYTYPE_LP:
2056                 if (rev == 13)
2057                         filename = "lp0bsinitvals13";
2058                 else if (rev == 14)
2059                         filename = "lp0bsinitvals14";
2060                 else if (rev >= 15)
2061                         filename = "lp0bsinitvals15";
2062                 else
2063                         goto err_no_initvals;
2064                 break;
2065         default:
2066                 goto err_no_initvals;
2067         }
2068         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2069         if (err)
2070                 goto err_load;
2071
2072         return 0;
2073
2074 err_no_ucode:
2075         err = ctx->fatal_failure = -EOPNOTSUPP;
2076         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2077                "is required for your device (wl-core rev %u)\n", rev);
2078         goto error;
2079
2080 err_no_pcm:
2081         err = ctx->fatal_failure = -EOPNOTSUPP;
2082         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2083                "is required for your device (wl-core rev %u)\n", rev);
2084         goto error;
2085
2086 err_no_initvals:
2087         err = ctx->fatal_failure = -EOPNOTSUPP;
2088         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2089                "is required for your device (wl-core rev %u)\n", rev);
2090         goto error;
2091
2092 err_load:
2093         /* We failed to load this firmware image. The error message
2094          * already is in ctx->errors. Return and let our caller decide
2095          * what to do. */
2096         goto error;
2097
2098 error:
2099         b43_release_firmware(dev);
2100         return err;
2101 }
2102
2103 static int b43_request_firmware(struct b43_wldev *dev)
2104 {
2105         struct b43_request_fw_context *ctx;
2106         unsigned int i;
2107         int err;
2108         const char *errmsg;
2109
2110         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2111         if (!ctx)
2112                 return -ENOMEM;
2113         ctx->dev = dev;
2114
2115         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2116         err = b43_try_request_fw(ctx);
2117         if (!err)
2118                 goto out; /* Successfully loaded it. */
2119         err = ctx->fatal_failure;
2120         if (err)
2121                 goto out;
2122
2123         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2124         err = b43_try_request_fw(ctx);
2125         if (!err)
2126                 goto out; /* Successfully loaded it. */
2127         err = ctx->fatal_failure;
2128         if (err)
2129                 goto out;
2130
2131         /* Could not find a usable firmware. Print the errors. */
2132         for (i = 0; i < B43_NR_FWTYPES; i++) {
2133                 errmsg = ctx->errors[i];
2134                 if (strlen(errmsg))
2135                         b43err(dev->wl, errmsg);
2136         }
2137         b43_print_fw_helptext(dev->wl, 1);
2138         err = -ENOENT;
2139
2140 out:
2141         kfree(ctx);
2142         return err;
2143 }
2144
2145 static int b43_upload_microcode(struct b43_wldev *dev)
2146 {
2147         const size_t hdr_len = sizeof(struct b43_fw_header);
2148         const __be32 *data;
2149         unsigned int i, len;
2150         u16 fwrev, fwpatch, fwdate, fwtime;
2151         u32 tmp, macctl;
2152         int err = 0;
2153
2154         /* Jump the microcode PSM to offset 0 */
2155         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2156         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2157         macctl |= B43_MACCTL_PSM_JMP0;
2158         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2159         /* Zero out all microcode PSM registers and shared memory. */
2160         for (i = 0; i < 64; i++)
2161                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2162         for (i = 0; i < 4096; i += 2)
2163                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2164
2165         /* Upload Microcode. */
2166         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2167         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2168         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2169         for (i = 0; i < len; i++) {
2170                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2171                 udelay(10);
2172         }
2173
2174         if (dev->fw.pcm.data) {
2175                 /* Upload PCM data. */
2176                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2177                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2178                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2179                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2180                 /* No need for autoinc bit in SHM_HW */
2181                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2182                 for (i = 0; i < len; i++) {
2183                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2184                         udelay(10);
2185                 }
2186         }
2187
2188         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2189
2190         /* Start the microcode PSM */
2191         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2192         macctl &= ~B43_MACCTL_PSM_JMP0;
2193         macctl |= B43_MACCTL_PSM_RUN;
2194         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2195
2196         /* Wait for the microcode to load and respond */
2197         i = 0;
2198         while (1) {
2199                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2200                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2201                         break;
2202                 i++;
2203                 if (i >= 20) {
2204                         b43err(dev->wl, "Microcode not responding\n");
2205                         b43_print_fw_helptext(dev->wl, 1);
2206                         err = -ENODEV;
2207                         goto error;
2208                 }
2209                 msleep_interruptible(50);
2210                 if (signal_pending(current)) {
2211                         err = -EINTR;
2212                         goto error;
2213                 }
2214         }
2215         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2216
2217         /* Get and check the revisions. */
2218         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2219         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2220         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2221         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2222
2223         if (fwrev <= 0x128) {
2224                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2225                        "binary drivers older than version 4.x is unsupported. "
2226                        "You must upgrade your firmware files.\n");
2227                 b43_print_fw_helptext(dev->wl, 1);
2228                 err = -EOPNOTSUPP;
2229                 goto error;
2230         }
2231         dev->fw.rev = fwrev;
2232         dev->fw.patch = fwpatch;
2233         dev->fw.opensource = (fwdate == 0xFFFF);
2234
2235         /* Default to use-all-queues. */
2236         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2237         dev->qos_enabled = !!modparam_qos;
2238         /* Default to firmware/hardware crypto acceleration. */
2239         dev->hwcrypto_enabled = 1;
2240
2241         if (dev->fw.opensource) {
2242                 u16 fwcapa;
2243
2244                 /* Patchlevel info is encoded in the "time" field. */
2245                 dev->fw.patch = fwtime;
2246                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2247                         dev->fw.rev, dev->fw.patch);
2248
2249                 fwcapa = b43_fwcapa_read(dev);
2250                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2251                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2252                         /* Disable hardware crypto and fall back to software crypto. */
2253                         dev->hwcrypto_enabled = 0;
2254                 }
2255                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2256                         b43info(dev->wl, "QoS not supported by firmware\n");
2257                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2258                          * ieee80211_unregister to make sure the networking core can
2259                          * properly free possible resources. */
2260                         dev->wl->hw->queues = 1;
2261                         dev->qos_enabled = 0;
2262                 }
2263         } else {
2264                 b43info(dev->wl, "Loading firmware version %u.%u "
2265                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2266                         fwrev, fwpatch,
2267                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2268                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2269                 if (dev->fw.pcm_request_failed) {
2270                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2271                                 "Hardware accelerated cryptography is disabled.\n");
2272                         b43_print_fw_helptext(dev->wl, 0);
2273                 }
2274         }
2275
2276         if (b43_is_old_txhdr_format(dev)) {
2277                 /* We're over the deadline, but we keep support for old fw
2278                  * until it turns out to be in major conflict with something new. */
2279                 b43warn(dev->wl, "You are using an old firmware image. "
2280                         "Support for old firmware will be removed soon "
2281                         "(official deadline was July 2008).\n");
2282                 b43_print_fw_helptext(dev->wl, 0);
2283         }
2284
2285         return 0;
2286
2287 error:
2288         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2289         macctl &= ~B43_MACCTL_PSM_RUN;
2290         macctl |= B43_MACCTL_PSM_JMP0;
2291         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2292
2293         return err;
2294 }
2295
2296 static int b43_write_initvals(struct b43_wldev *dev,
2297                               const struct b43_iv *ivals,
2298                               size_t count,
2299                               size_t array_size)
2300 {
2301         const struct b43_iv *iv;
2302         u16 offset;
2303         size_t i;
2304         bool bit32;
2305
2306         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2307         iv = ivals;
2308         for (i = 0; i < count; i++) {
2309                 if (array_size < sizeof(iv->offset_size))
2310                         goto err_format;
2311                 array_size -= sizeof(iv->offset_size);
2312                 offset = be16_to_cpu(iv->offset_size);
2313                 bit32 = !!(offset & B43_IV_32BIT);
2314                 offset &= B43_IV_OFFSET_MASK;
2315                 if (offset >= 0x1000)
2316                         goto err_format;
2317                 if (bit32) {
2318                         u32 value;
2319
2320                         if (array_size < sizeof(iv->data.d32))
2321                                 goto err_format;
2322                         array_size -= sizeof(iv->data.d32);
2323
2324                         value = get_unaligned_be32(&iv->data.d32);
2325                         b43_write32(dev, offset, value);
2326
2327                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2328                                                         sizeof(__be16) +
2329                                                         sizeof(__be32));
2330                 } else {
2331                         u16 value;
2332
2333                         if (array_size < sizeof(iv->data.d16))
2334                                 goto err_format;
2335                         array_size -= sizeof(iv->data.d16);
2336
2337                         value = be16_to_cpu(iv->data.d16);
2338                         b43_write16(dev, offset, value);
2339
2340                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2341                                                         sizeof(__be16) +
2342                                                         sizeof(__be16));
2343                 }
2344         }
2345         if (array_size)
2346                 goto err_format;
2347
2348         return 0;
2349
2350 err_format:
2351         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2352         b43_print_fw_helptext(dev->wl, 1);
2353
2354         return -EPROTO;
2355 }
2356
2357 static int b43_upload_initvals(struct b43_wldev *dev)
2358 {
2359         const size_t hdr_len = sizeof(struct b43_fw_header);
2360         const struct b43_fw_header *hdr;
2361         struct b43_firmware *fw = &dev->fw;
2362         const struct b43_iv *ivals;
2363         size_t count;
2364         int err;
2365
2366         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2367         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2368         count = be32_to_cpu(hdr->size);
2369         err = b43_write_initvals(dev, ivals, count,
2370                                  fw->initvals.data->size - hdr_len);
2371         if (err)
2372                 goto out;
2373         if (fw->initvals_band.data) {
2374                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2375                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2376                 count = be32_to_cpu(hdr->size);
2377                 err = b43_write_initvals(dev, ivals, count,
2378                                          fw->initvals_band.data->size - hdr_len);
2379                 if (err)
2380                         goto out;
2381         }
2382 out:
2383
2384         return err;
2385 }
2386
2387 /* Initialize the GPIOs
2388  * http://bcm-specs.sipsolutions.net/GPIO
2389  */
2390 static int b43_gpio_init(struct b43_wldev *dev)
2391 {
2392         struct ssb_bus *bus = dev->dev->bus;
2393         struct ssb_device *gpiodev, *pcidev = NULL;
2394         u32 mask, set;
2395
2396         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2397                     & ~B43_MACCTL_GPOUTSMSK);
2398
2399         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2400                     | 0x000F);
2401
2402         mask = 0x0000001F;
2403         set = 0x0000000F;
2404         if (dev->dev->bus->chip_id == 0x4301) {
2405                 mask |= 0x0060;
2406                 set |= 0x0060;
2407         }
2408         if (0 /* FIXME: conditional unknown */ ) {
2409                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2410                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2411                             | 0x0100);
2412                 mask |= 0x0180;
2413                 set |= 0x0180;
2414         }
2415         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2416                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2417                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2418                             | 0x0200);
2419                 mask |= 0x0200;
2420                 set |= 0x0200;
2421         }
2422         if (dev->dev->id.revision >= 2)
2423                 mask |= 0x0010; /* FIXME: This is redundant. */
2424
2425 #ifdef CONFIG_SSB_DRIVER_PCICORE
2426         pcidev = bus->pcicore.dev;
2427 #endif
2428         gpiodev = bus->chipco.dev ? : pcidev;
2429         if (!gpiodev)
2430                 return 0;
2431         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2432                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2433                      & mask) | set);
2434
2435         return 0;
2436 }
2437
2438 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2439 static void b43_gpio_cleanup(struct b43_wldev *dev)
2440 {
2441         struct ssb_bus *bus = dev->dev->bus;
2442         struct ssb_device *gpiodev, *pcidev = NULL;
2443
2444 #ifdef CONFIG_SSB_DRIVER_PCICORE
2445         pcidev = bus->pcicore.dev;
2446 #endif
2447         gpiodev = bus->chipco.dev ? : pcidev;
2448         if (!gpiodev)
2449                 return;
2450         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2451 }
2452
2453 /* http://bcm-specs.sipsolutions.net/EnableMac */
2454 void b43_mac_enable(struct b43_wldev *dev)
2455 {
2456         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2457                 u16 fwstate;
2458
2459                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2460                                          B43_SHM_SH_UCODESTAT);
2461                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2462                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2463                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2464                                "should be suspended, but current state is %u\n",
2465                                fwstate);
2466                 }
2467         }
2468
2469         dev->mac_suspended--;
2470         B43_WARN_ON(dev->mac_suspended < 0);
2471         if (dev->mac_suspended == 0) {
2472                 b43_write32(dev, B43_MMIO_MACCTL,
2473                             b43_read32(dev, B43_MMIO_MACCTL)
2474                             | B43_MACCTL_ENABLED);
2475                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2476                             B43_IRQ_MAC_SUSPENDED);
2477                 /* Commit writes */
2478                 b43_read32(dev, B43_MMIO_MACCTL);
2479                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2480                 b43_power_saving_ctl_bits(dev, 0);
2481         }
2482 }
2483
2484 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2485 void b43_mac_suspend(struct b43_wldev *dev)
2486 {
2487         int i;
2488         u32 tmp;
2489
2490         might_sleep();
2491         B43_WARN_ON(dev->mac_suspended < 0);
2492
2493         if (dev->mac_suspended == 0) {
2494                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2495                 b43_write32(dev, B43_MMIO_MACCTL,
2496                             b43_read32(dev, B43_MMIO_MACCTL)
2497                             & ~B43_MACCTL_ENABLED);
2498                 /* force pci to flush the write */
2499                 b43_read32(dev, B43_MMIO_MACCTL);
2500                 for (i = 35; i; i--) {
2501                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2502                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2503                                 goto out;
2504                         udelay(10);
2505                 }
2506                 /* Hm, it seems this will take some time. Use msleep(). */
2507                 for (i = 40; i; i--) {
2508                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2509                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2510                                 goto out;
2511                         msleep(1);
2512                 }
2513                 b43err(dev->wl, "MAC suspend failed\n");
2514         }
2515 out:
2516         dev->mac_suspended++;
2517 }
2518
2519 static void b43_adjust_opmode(struct b43_wldev *dev)
2520 {
2521         struct b43_wl *wl = dev->wl;
2522         u32 ctl;
2523         u16 cfp_pretbtt;
2524
2525         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2526         /* Reset status to STA infrastructure mode. */
2527         ctl &= ~B43_MACCTL_AP;
2528         ctl &= ~B43_MACCTL_KEEP_CTL;
2529         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2530         ctl &= ~B43_MACCTL_KEEP_BAD;
2531         ctl &= ~B43_MACCTL_PROMISC;
2532         ctl &= ~B43_MACCTL_BEACPROMISC;
2533         ctl |= B43_MACCTL_INFRA;
2534
2535         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2536             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2537                 ctl |= B43_MACCTL_AP;
2538         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2539                 ctl &= ~B43_MACCTL_INFRA;
2540
2541         if (wl->filter_flags & FIF_CONTROL)
2542                 ctl |= B43_MACCTL_KEEP_CTL;
2543         if (wl->filter_flags & FIF_FCSFAIL)
2544                 ctl |= B43_MACCTL_KEEP_BAD;
2545         if (wl->filter_flags & FIF_PLCPFAIL)
2546                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2547         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2548                 ctl |= B43_MACCTL_PROMISC;
2549         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2550                 ctl |= B43_MACCTL_BEACPROMISC;
2551
2552         /* Workaround: On old hardware the HW-MAC-address-filter
2553          * doesn't work properly, so always run promisc in filter
2554          * it in software. */
2555         if (dev->dev->id.revision <= 4)
2556                 ctl |= B43_MACCTL_PROMISC;
2557
2558         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2559
2560         cfp_pretbtt = 2;
2561         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2562                 if (dev->dev->bus->chip_id == 0x4306 &&
2563                     dev->dev->bus->chip_rev == 3)
2564                         cfp_pretbtt = 100;
2565                 else
2566                         cfp_pretbtt = 50;
2567         }
2568         b43_write16(dev, 0x612, cfp_pretbtt);
2569 }
2570
2571 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2572 {
2573         u16 offset;
2574
2575         if (is_ofdm) {
2576                 offset = 0x480;
2577                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2578         } else {
2579                 offset = 0x4C0;
2580                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2581         }
2582         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2583                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2584 }
2585
2586 static void b43_rate_memory_init(struct b43_wldev *dev)
2587 {
2588         switch (dev->phy.type) {
2589         case B43_PHYTYPE_A:
2590         case B43_PHYTYPE_G:
2591         case B43_PHYTYPE_N:
2592         case B43_PHYTYPE_LP:
2593                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2594                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2595                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2596                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2597                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2598                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2599                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2600                 if (dev->phy.type == B43_PHYTYPE_A)
2601                         break;
2602                 /* fallthrough */
2603         case B43_PHYTYPE_B:
2604                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2605                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2606                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2607                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2608                 break;
2609         default:
2610                 B43_WARN_ON(1);
2611         }
2612 }
2613
2614 /* Set the default values for the PHY TX Control Words. */
2615 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2616 {
2617         u16 ctl = 0;
2618
2619         ctl |= B43_TXH_PHY_ENC_CCK;
2620         ctl |= B43_TXH_PHY_ANT01AUTO;
2621         ctl |= B43_TXH_PHY_TXPWR;
2622
2623         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2624         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2625         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2626 }
2627
2628 /* Set the TX-Antenna for management frames sent by firmware. */
2629 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2630 {
2631         u16 ant;
2632         u16 tmp;
2633
2634         ant = b43_antenna_to_phyctl(antenna);
2635
2636         /* For ACK/CTS */
2637         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2638         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2639         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2640         /* For Probe Resposes */
2641         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2642         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2643         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2644 }
2645
2646 /* This is the opposite of b43_chip_init() */
2647 static void b43_chip_exit(struct b43_wldev *dev)
2648 {
2649         b43_phy_exit(dev);
2650         b43_gpio_cleanup(dev);
2651         /* firmware is released later */
2652 }
2653
2654 /* Initialize the chip
2655  * http://bcm-specs.sipsolutions.net/ChipInit
2656  */
2657 static int b43_chip_init(struct b43_wldev *dev)
2658 {
2659         struct b43_phy *phy = &dev->phy;
2660         int err;
2661         u32 value32, macctl;
2662         u16 value16;
2663
2664         /* Initialize the MAC control */
2665         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2666         if (dev->phy.gmode)
2667                 macctl |= B43_MACCTL_GMODE;
2668         macctl |= B43_MACCTL_INFRA;
2669         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2670
2671         err = b43_request_firmware(dev);
2672         if (err)
2673                 goto out;
2674         err = b43_upload_microcode(dev);
2675         if (err)
2676                 goto out;       /* firmware is released later */
2677
2678         err = b43_gpio_init(dev);
2679         if (err)
2680                 goto out;       /* firmware is released later */
2681
2682         err = b43_upload_initvals(dev);
2683         if (err)
2684                 goto err_gpio_clean;
2685
2686         /* Turn the Analog on and initialize the PHY. */
2687         phy->ops->switch_analog(dev, 1);
2688         err = b43_phy_init(dev);
2689         if (err)
2690                 goto err_gpio_clean;
2691
2692         /* Disable Interference Mitigation. */
2693         if (phy->ops->interf_mitigation)
2694                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2695
2696         /* Select the antennae */
2697         if (phy->ops->set_rx_antenna)
2698                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2699         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2700
2701         if (phy->type == B43_PHYTYPE_B) {
2702                 value16 = b43_read16(dev, 0x005E);
2703                 value16 |= 0x0004;
2704                 b43_write16(dev, 0x005E, value16);
2705         }
2706         b43_write32(dev, 0x0100, 0x01000000);
2707         if (dev->dev->id.revision < 5)
2708                 b43_write32(dev, 0x010C, 0x01000000);
2709
2710         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2711                     & ~B43_MACCTL_INFRA);
2712         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2713                     | B43_MACCTL_INFRA);
2714
2715         /* Probe Response Timeout value */
2716         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2717         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2718
2719         /* Initially set the wireless operation mode. */
2720         b43_adjust_opmode(dev);
2721
2722         if (dev->dev->id.revision < 3) {
2723                 b43_write16(dev, 0x060E, 0x0000);
2724                 b43_write16(dev, 0x0610, 0x8000);
2725                 b43_write16(dev, 0x0604, 0x0000);
2726                 b43_write16(dev, 0x0606, 0x0200);
2727         } else {
2728                 b43_write32(dev, 0x0188, 0x80000000);
2729                 b43_write32(dev, 0x018C, 0x02000000);
2730         }
2731         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2732         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2733         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2734         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2735         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2736         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2737         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2738
2739         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2740         value32 |= 0x00100000;
2741         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2742
2743         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2744                     dev->dev->bus->chipco.fast_pwrup_delay);
2745
2746         err = 0;
2747         b43dbg(dev->wl, "Chip initialized\n");
2748 out:
2749         return err;
2750
2751 err_gpio_clean:
2752         b43_gpio_cleanup(dev);
2753         return err;
2754 }
2755
2756 static void b43_periodic_every60sec(struct b43_wldev *dev)
2757 {
2758         const struct b43_phy_operations *ops = dev->phy.ops;
2759
2760         if (ops->pwork_60sec)
2761                 ops->pwork_60sec(dev);
2762
2763         /* Force check the TX power emission now. */
2764         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2765 }
2766
2767 static void b43_periodic_every30sec(struct b43_wldev *dev)
2768 {
2769         /* Update device statistics. */
2770         b43_calculate_link_quality(dev);
2771 }
2772
2773 static void b43_periodic_every15sec(struct b43_wldev *dev)
2774 {
2775         struct b43_phy *phy = &dev->phy;
2776         u16 wdr;
2777
2778         if (dev->fw.opensource) {
2779                 /* Check if the firmware is still alive.
2780                  * It will reset the watchdog counter to 0 in its idle loop. */
2781                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2782                 if (unlikely(wdr)) {
2783                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2784                         b43_controller_restart(dev, "Firmware watchdog");
2785                         return;
2786                 } else {
2787                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2788                                         B43_WATCHDOG_REG, 1);
2789                 }
2790         }
2791
2792         if (phy->ops->pwork_15sec)
2793                 phy->ops->pwork_15sec(dev);
2794
2795         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2796         wmb();
2797 }
2798
2799 static void do_periodic_work(struct b43_wldev *dev)
2800 {
2801         unsigned int state;
2802
2803         state = dev->periodic_state;
2804         if (state % 4 == 0)
2805                 b43_periodic_every60sec(dev);
2806         if (state % 2 == 0)
2807                 b43_periodic_every30sec(dev);
2808         b43_periodic_every15sec(dev);
2809 }
2810
2811 /* Periodic work locking policy:
2812  *      The whole periodic work handler is protected by
2813  *      wl->mutex. If another lock is needed somewhere in the
2814  *      pwork callchain, it's aquired in-place, where it's needed.
2815  */
2816 static void b43_periodic_work_handler(struct work_struct *work)
2817 {
2818         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2819                                              periodic_work.work);
2820         struct b43_wl *wl = dev->wl;
2821         unsigned long delay;
2822
2823         mutex_lock(&wl->mutex);
2824
2825         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2826                 goto out;
2827         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2828                 goto out_requeue;
2829
2830         do_periodic_work(dev);
2831
2832         dev->periodic_state++;
2833 out_requeue:
2834         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2835                 delay = msecs_to_jiffies(50);
2836         else
2837                 delay = round_jiffies_relative(HZ * 15);
2838         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2839 out:
2840         mutex_unlock(&wl->mutex);
2841 }
2842
2843 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2844 {
2845         struct delayed_work *work = &dev->periodic_work;
2846
2847         dev->periodic_state = 0;
2848         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2849         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2850 }
2851
2852 /* Check if communication with the device works correctly. */
2853 static int b43_validate_chipaccess(struct b43_wldev *dev)
2854 {
2855         u32 v, backup0, backup4;
2856
2857         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2858         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2859
2860         /* Check for read/write and endianness problems. */
2861         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2862         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2863                 goto error;
2864         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2865         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2866                 goto error;
2867
2868         /* Check if unaligned 32bit SHM_SHARED access works properly.
2869          * However, don't bail out on failure, because it's noncritical. */
2870         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2871         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2872         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2873         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2874         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2875                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2876         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2877         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2878             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2879             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2880             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2881                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2882
2883         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2884         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2885
2886         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2887                 /* The 32bit register shadows the two 16bit registers
2888                  * with update sideeffects. Validate this. */
2889                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2890                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2891                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2892                         goto error;
2893                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2894                         goto error;
2895         }
2896         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2897
2898         v = b43_read32(dev, B43_MMIO_MACCTL);
2899         v |= B43_MACCTL_GMODE;
2900         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2901                 goto error;
2902
2903         return 0;
2904 error:
2905         b43err(dev->wl, "Failed to validate the chipaccess\n");
2906         return -ENODEV;
2907 }
2908
2909 static void b43_security_init(struct b43_wldev *dev)
2910 {
2911         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2912         /* KTP is a word address, but we address SHM bytewise.
2913          * So multiply by two.
2914          */
2915         dev->ktp *= 2;
2916         /* Number of RCMTA address slots */
2917         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
2918         /* Clear the key memory. */
2919         b43_clear_keys(dev);
2920 }
2921
2922 #ifdef CONFIG_B43_HWRNG
2923 static int b43_rng_read(struct hwrng *rng, u32 *data)
2924 {
2925         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2926         unsigned long flags;
2927
2928         /* Don't take wl->mutex here, as it could deadlock with
2929          * hwrng internal locking. It's not needed to take
2930          * wl->mutex here, anyway. */
2931
2932         spin_lock_irqsave(&wl->irq_lock, flags);
2933         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2934         spin_unlock_irqrestore(&wl->irq_lock, flags);
2935
2936         return (sizeof(u16));
2937 }
2938 #endif /* CONFIG_B43_HWRNG */
2939
2940 static void b43_rng_exit(struct b43_wl *wl)
2941 {
2942 #ifdef CONFIG_B43_HWRNG
2943         if (wl->rng_initialized)
2944                 hwrng_unregister(&wl->rng);
2945 #endif /* CONFIG_B43_HWRNG */
2946 }
2947
2948 static int b43_rng_init(struct b43_wl *wl)
2949 {
2950         int err = 0;
2951
2952 #ifdef CONFIG_B43_HWRNG
2953         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2954                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2955         wl->rng.name = wl->rng_name;
2956         wl->rng.data_read = b43_rng_read;
2957         wl->rng.priv = (unsigned long)wl;
2958         wl->rng_initialized = 1;
2959         err = hwrng_register(&wl->rng);
2960         if (err) {
2961                 wl->rng_initialized = 0;
2962                 b43err(wl, "Failed to register the random "
2963                        "number generator (%d)\n", err);
2964         }
2965 #endif /* CONFIG_B43_HWRNG */
2966
2967         return err;
2968 }
2969
2970 static int b43_op_tx(struct ieee80211_hw *hw,
2971                      struct sk_buff *skb)
2972 {
2973         struct b43_wl *wl = hw_to_b43_wl(hw);
2974         struct b43_wldev *dev = wl->current_dev;
2975         unsigned long flags;
2976         int err;
2977
2978         if (unlikely(skb->len < 2 + 2 + 6)) {
2979                 /* Too short, this can't be a valid frame. */
2980                 goto drop_packet;
2981         }
2982         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2983         if (unlikely(!dev))
2984                 goto drop_packet;
2985
2986         /* Transmissions on seperate queues can run concurrently. */
2987         read_lock_irqsave(&wl->tx_lock, flags);
2988
2989         err = -ENODEV;
2990         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2991                 if (b43_using_pio_transfers(dev))
2992                         err = b43_pio_tx(dev, skb);
2993                 else
2994                         err = b43_dma_tx(dev, skb);
2995         }
2996
2997         read_unlock_irqrestore(&wl->tx_lock, flags);
2998
2999         if (unlikely(err))
3000                 goto drop_packet;
3001         return NETDEV_TX_OK;
3002
3003 drop_packet:
3004         /* We can not transmit this packet. Drop it. */
3005         dev_kfree_skb_any(skb);
3006         return NETDEV_TX_OK;
3007 }
3008
3009 /* Locking: wl->irq_lock */
3010 static void b43_qos_params_upload(struct b43_wldev *dev,
3011                                   const struct ieee80211_tx_queue_params *p,
3012                                   u16 shm_offset)
3013 {
3014         u16 params[B43_NR_QOSPARAMS];
3015         int bslots, tmp;
3016         unsigned int i;
3017
3018         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3019
3020         memset(&params, 0, sizeof(params));
3021
3022         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3023         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3024         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3025         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3026         params[B43_QOSPARAM_AIFS] = p->aifs;
3027         params[B43_QOSPARAM_BSLOTS] = bslots;
3028         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3029
3030         for (i = 0; i < ARRAY_SIZE(params); i++) {
3031                 if (i == B43_QOSPARAM_STATUS) {
3032                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3033                                              shm_offset + (i * 2));
3034                         /* Mark the parameters as updated. */
3035                         tmp |= 0x100;
3036                         b43_shm_write16(dev, B43_SHM_SHARED,
3037                                         shm_offset + (i * 2),
3038                                         tmp);
3039                 } else {
3040                         b43_shm_write16(dev, B43_SHM_SHARED,
3041                                         shm_offset + (i * 2),
3042                                         params[i]);
3043                 }
3044         }
3045 }
3046
3047 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3048 static const u16 b43_qos_shm_offsets[] = {
3049         /* [mac80211-queue-nr] = SHM_OFFSET, */
3050         [0] = B43_QOS_VOICE,
3051         [1] = B43_QOS_VIDEO,
3052         [2] = B43_QOS_BESTEFFORT,
3053         [3] = B43_QOS_BACKGROUND,
3054 };
3055
3056 /* Update all QOS parameters in hardware. */
3057 static void b43_qos_upload_all(struct b43_wldev *dev)
3058 {
3059         struct b43_wl *wl = dev->wl;
3060         struct b43_qos_params *params;
3061         unsigned int i;
3062
3063         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3064                      ARRAY_SIZE(wl->qos_params));
3065
3066         b43_mac_suspend(dev);
3067         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3068                 params = &(wl->qos_params[i]);
3069                 b43_qos_params_upload(dev, &(params->p),
3070                                       b43_qos_shm_offsets[i]);
3071         }
3072         b43_mac_enable(dev);
3073 }
3074
3075 static void b43_qos_clear(struct b43_wl *wl)
3076 {
3077         struct b43_qos_params *params;
3078         unsigned int i;
3079
3080         /* Initialize QoS parameters to sane defaults. */
3081
3082         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3083                      ARRAY_SIZE(wl->qos_params));
3084
3085         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3086                 params = &(wl->qos_params[i]);
3087
3088                 switch (b43_qos_shm_offsets[i]) {
3089                 case B43_QOS_VOICE:
3090                         params->p.txop = 0;
3091                         params->p.aifs = 2;
3092                         params->p.cw_min = 0x0001;
3093                         params->p.cw_max = 0x0001;
3094                         break;
3095                 case B43_QOS_VIDEO:
3096                         params->p.txop = 0;
3097                         params->p.aifs = 2;
3098                         params->p.cw_min = 0x0001;
3099                         params->p.cw_max = 0x0001;
3100                         break;
3101                 case B43_QOS_BESTEFFORT:
3102                         params->p.txop = 0;
3103                         params->p.aifs = 3;
3104                         params->p.cw_min = 0x0001;
3105                         params->p.cw_max = 0x03FF;
3106                         break;
3107                 case B43_QOS_BACKGROUND:
3108                         params->p.txop = 0;
3109                         params->p.aifs = 7;
3110                         params->p.cw_min = 0x0001;
3111                         params->p.cw_max = 0x03FF;
3112                         break;
3113                 default:
3114                         B43_WARN_ON(1);
3115                 }
3116         }
3117 }
3118
3119 /* Initialize the core's QOS capabilities */
3120 static void b43_qos_init(struct b43_wldev *dev)
3121 {
3122         /* Upload the current QOS parameters. */
3123         b43_qos_upload_all(dev);
3124
3125         /* Enable QOS support. */
3126         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3127         b43_write16(dev, B43_MMIO_IFSCTL,
3128                     b43_read16(dev, B43_MMIO_IFSCTL)
3129                     | B43_MMIO_IFSCTL_USE_EDCF);
3130 }
3131
3132 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3133                           const struct ieee80211_tx_queue_params *params)
3134 {
3135         struct b43_wl *wl = hw_to_b43_wl(hw);
3136         struct b43_wldev *dev;
3137         unsigned int queue = (unsigned int)_queue;
3138         int err = -ENODEV;
3139
3140         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3141                 /* Queue not available or don't support setting
3142                  * params on this queue. Return success to not
3143                  * confuse mac80211. */
3144                 return 0;
3145         }
3146         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3147                      ARRAY_SIZE(wl->qos_params));
3148
3149         mutex_lock(&wl->mutex);
3150         dev = wl->current_dev;
3151         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3152                 goto out_unlock;
3153
3154         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3155         b43_mac_suspend(dev);
3156         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3157                               b43_qos_shm_offsets[queue]);
3158         b43_mac_enable(dev);
3159         err = 0;
3160
3161 out_unlock:
3162         mutex_unlock(&wl->mutex);
3163
3164         return err;
3165 }
3166
3167 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3168                                struct ieee80211_tx_queue_stats *stats)
3169 {
3170         struct b43_wl *wl = hw_to_b43_wl(hw);
3171         struct b43_wldev *dev = wl->current_dev;
3172         unsigned long flags;
3173         int err = -ENODEV;
3174
3175         if (!dev)
3176                 goto out;
3177         spin_lock_irqsave(&wl->irq_lock, flags);
3178         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3179                 if (b43_using_pio_transfers(dev))
3180                         b43_pio_get_tx_stats(dev, stats);
3181                 else
3182                         b43_dma_get_tx_stats(dev, stats);
3183                 err = 0;
3184         }
3185         spin_unlock_irqrestore(&wl->irq_lock, flags);
3186 out:
3187         return err;
3188 }
3189
3190 static int b43_op_get_stats(struct ieee80211_hw *hw,
3191                             struct ieee80211_low_level_stats *stats)
3192 {
3193         struct b43_wl *wl = hw_to_b43_wl(hw);
3194         unsigned long flags;
3195
3196         spin_lock_irqsave(&wl->irq_lock, flags);
3197         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3198         spin_unlock_irqrestore(&wl->irq_lock, flags);
3199
3200         return 0;
3201 }
3202
3203 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3204 {
3205         struct b43_wl *wl = hw_to_b43_wl(hw);
3206         struct b43_wldev *dev;
3207         u64 tsf;
3208
3209         mutex_lock(&wl->mutex);
3210         spin_lock_irq(&wl->irq_lock);
3211         dev = wl->current_dev;
3212
3213         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3214                 b43_tsf_read(dev, &tsf);
3215         else
3216                 tsf = 0;
3217
3218         spin_unlock_irq(&wl->irq_lock);
3219         mutex_unlock(&wl->mutex);
3220
3221         return tsf;
3222 }
3223
3224 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3225 {
3226         struct b43_wl *wl = hw_to_b43_wl(hw);
3227         struct b43_wldev *dev;
3228
3229         mutex_lock(&wl->mutex);
3230         spin_lock_irq(&wl->irq_lock);
3231         dev = wl->current_dev;
3232
3233         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3234                 b43_tsf_write(dev, tsf);
3235
3236         spin_unlock_irq(&wl->irq_lock);
3237         mutex_unlock(&wl->mutex);
3238 }
3239
3240 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3241 {
3242         struct ssb_device *sdev = dev->dev;
3243         u32 tmslow;
3244
3245         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3246         tmslow &= ~B43_TMSLOW_GMODE;
3247         tmslow |= B43_TMSLOW_PHYRESET;
3248         tmslow |= SSB_TMSLOW_FGC;
3249         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3250         msleep(1);
3251
3252         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3253         tmslow &= ~SSB_TMSLOW_FGC;
3254         tmslow |= B43_TMSLOW_PHYRESET;
3255         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3256         msleep(1);
3257 }
3258
3259 static const char *band_to_string(enum ieee80211_band band)
3260 {
3261         switch (band) {
3262         case IEEE80211_BAND_5GHZ:
3263                 return "5";
3264         case IEEE80211_BAND_2GHZ:
3265                 return "2.4";
3266         default:
3267                 break;
3268         }
3269         B43_WARN_ON(1);
3270         return "";
3271 }
3272
3273 /* Expects wl->mutex locked */
3274 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3275 {
3276         struct b43_wldev *up_dev = NULL;
3277         struct b43_wldev *down_dev;
3278         struct b43_wldev *d;
3279         int err;
3280         bool uninitialized_var(gmode);
3281         int prev_status;
3282
3283         /* Find a device and PHY which supports the band. */
3284         list_for_each_entry(d, &wl->devlist, list) {
3285                 switch (chan->band) {
3286                 case IEEE80211_BAND_5GHZ:
3287                         if (d->phy.supports_5ghz) {
3288                                 up_dev = d;
3289                                 gmode = 0;
3290                         }
3291                         break;
3292                 case IEEE80211_BAND_2GHZ:
3293                         if (d->phy.supports_2ghz) {
3294                                 up_dev = d;
3295                                 gmode = 1;
3296                         }
3297                         break;
3298                 default:
3299                         B43_WARN_ON(1);
3300                         return -EINVAL;
3301                 }
3302                 if (up_dev)
3303                         break;
3304         }
3305         if (!up_dev) {
3306                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3307                        band_to_string(chan->band));
3308                 return -ENODEV;
3309         }
3310         if ((up_dev == wl->current_dev) &&
3311             (!!wl->current_dev->phy.gmode == !!gmode)) {
3312                 /* This device is already running. */
3313                 return 0;
3314         }
3315         b43dbg(wl, "Switching to %s-GHz band\n",
3316                band_to_string(chan->band));
3317         down_dev = wl->current_dev;
3318
3319         prev_status = b43_status(down_dev);
3320         /* Shutdown the currently running core. */
3321         if (prev_status >= B43_STAT_STARTED)
3322                 b43_wireless_core_stop(down_dev);
3323         if (prev_status >= B43_STAT_INITIALIZED)
3324                 b43_wireless_core_exit(down_dev);
3325
3326         if (down_dev != up_dev) {
3327                 /* We switch to a different core, so we put PHY into
3328                  * RESET on the old core. */
3329                 b43_put_phy_into_reset(down_dev);
3330         }
3331
3332         /* Now start the new core. */
3333         up_dev->phy.gmode = gmode;
3334         if (prev_status >= B43_STAT_INITIALIZED) {
3335                 err = b43_wireless_core_init(up_dev);
3336                 if (err) {
3337                         b43err(wl, "Fatal: Could not initialize device for "
3338                                "selected %s-GHz band\n",
3339                                band_to_string(chan->band));
3340                         goto init_failure;
3341                 }
3342         }
3343         if (prev_status >= B43_STAT_STARTED) {
3344                 err = b43_wireless_core_start(up_dev);
3345                 if (err) {
3346                         b43err(wl, "Fatal: Coult not start device for "
3347                                "selected %s-GHz band\n",
3348                                band_to_string(chan->band));
3349                         b43_wireless_core_exit(up_dev);
3350                         goto init_failure;
3351                 }
3352         }
3353         B43_WARN_ON(b43_status(up_dev) != prev_status);
3354
3355         wl->current_dev = up_dev;
3356
3357         return 0;
3358 init_failure:
3359         /* Whoops, failed to init the new core. No core is operating now. */
3360         wl->current_dev = NULL;
3361         return err;
3362 }
3363
3364 /* Write the short and long frame retry limit values. */
3365 static void b43_set_retry_limits(struct b43_wldev *dev,
3366                                  unsigned int short_retry,
3367                                  unsigned int long_retry)
3368 {
3369         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3370          * the chip-internal counter. */
3371         short_retry = min(short_retry, (unsigned int)0xF);
3372         long_retry = min(long_retry, (unsigned int)0xF);
3373
3374         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3375                         short_retry);
3376         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3377                         long_retry);
3378 }
3379
3380 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3381 {
3382         struct b43_wl *wl = hw_to_b43_wl(hw);
3383         struct b43_wldev *dev;
3384         struct b43_phy *phy;
3385         struct ieee80211_conf *conf = &hw->conf;
3386         unsigned long flags;
3387         int antenna;
3388         int err = 0;
3389
3390         mutex_lock(&wl->mutex);
3391
3392         /* Switch the band (if necessary). This might change the active core. */
3393         err = b43_switch_band(wl, conf->channel);
3394         if (err)
3395                 goto out_unlock_mutex;
3396         dev = wl->current_dev;
3397         phy = &dev->phy;
3398
3399         b43_mac_suspend(dev);
3400
3401         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3402                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3403                                           conf->long_frame_max_tx_count);
3404         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3405         if (!changed)
3406                 goto out_mac_enable;
3407
3408         /* Switch to the requested channel.
3409          * The firmware takes care of races with the TX handler. */
3410         if (conf->channel->hw_value != phy->channel)
3411                 b43_switch_channel(dev, conf->channel->hw_value);
3412
3413         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3414
3415         /* Adjust the desired TX power level. */
3416         if (conf->power_level != 0) {
3417                 spin_lock_irqsave(&wl->irq_lock, flags);
3418                 if (conf->power_level != phy->desired_txpower) {
3419                         phy->desired_txpower = conf->power_level;
3420                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3421                                                    B43_TXPWR_IGNORE_TSSI);
3422                 }
3423                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3424         }
3425
3426         /* Antennas for RX and management frame TX. */
3427         antenna = B43_ANTENNA_DEFAULT;
3428         b43_mgmtframe_txantenna(dev, antenna);
3429         antenna = B43_ANTENNA_DEFAULT;
3430         if (phy->ops->set_rx_antenna)
3431                 phy->ops->set_rx_antenna(dev, antenna);
3432
3433         if (wl->radio_enabled != phy->radio_on) {
3434                 if (wl->radio_enabled) {
3435                         b43_software_rfkill(dev, false);
3436                         b43info(dev->wl, "Radio turned on by software\n");
3437                         if (!dev->radio_hw_enable) {
3438                                 b43info(dev->wl, "The hardware RF-kill button "
3439                                         "still turns the radio physically off. "
3440                                         "Press the button to turn it on.\n");
3441                         }
3442                 } else {
3443                         b43_software_rfkill(dev, true);
3444                         b43info(dev->wl, "Radio turned off by software\n");
3445                 }
3446         }
3447
3448 out_mac_enable:
3449         b43_mac_enable(dev);
3450 out_unlock_mutex:
3451         mutex_unlock(&wl->mutex);
3452
3453         return err;
3454 }
3455
3456 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3457 {
3458         struct ieee80211_supported_band *sband =
3459                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3460         struct ieee80211_rate *rate;
3461         int i;
3462         u16 basic, direct, offset, basic_offset, rateptr;
3463
3464         for (i = 0; i < sband->n_bitrates; i++) {
3465                 rate = &sband->bitrates[i];
3466
3467                 if (b43_is_cck_rate(rate->hw_value)) {
3468                         direct = B43_SHM_SH_CCKDIRECT;
3469                         basic = B43_SHM_SH_CCKBASIC;
3470                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3471                         offset &= 0xF;
3472                 } else {
3473                         direct = B43_SHM_SH_OFDMDIRECT;
3474                         basic = B43_SHM_SH_OFDMBASIC;
3475                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3476                         offset &= 0xF;
3477                 }
3478
3479                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3480
3481                 if (b43_is_cck_rate(rate->hw_value)) {
3482                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3483                         basic_offset &= 0xF;
3484                 } else {
3485                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3486                         basic_offset &= 0xF;
3487                 }
3488
3489                 /*
3490                  * Get the pointer that we need to point to
3491                  * from the direct map
3492                  */
3493                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3494                                          direct + 2 * basic_offset);
3495                 /* and write it to the basic map */
3496                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3497                                 rateptr);
3498         }
3499 }
3500
3501 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3502                                     struct ieee80211_vif *vif,
3503                                     struct ieee80211_bss_conf *conf,
3504                                     u32 changed)
3505 {
3506         struct b43_wl *wl = hw_to_b43_wl(hw);
3507         struct b43_wldev *dev;
3508         unsigned long flags;
3509
3510         mutex_lock(&wl->mutex);
3511
3512         dev = wl->current_dev;
3513         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3514                 goto out_unlock_mutex;
3515
3516         B43_WARN_ON(wl->vif != vif);
3517
3518         spin_lock_irqsave(&wl->irq_lock, flags);
3519         if (changed & BSS_CHANGED_BSSID) {
3520                 if (conf->bssid)
3521                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3522                 else
3523                         memset(wl->bssid, 0, ETH_ALEN);
3524         }
3525
3526         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3527                 if (changed & BSS_CHANGED_BEACON &&<