drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode5.fw");
  76 MODULE_FIRMWARE("b43/ucode9.fw");
  77
  78 static int modparam_bad_frames_preempt;
  79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  80 MODULE_PARM_DESC(bad_frames_preempt,
  81                  "enable(1) / disable(0) Bad Frames Preemption");
  82
  83 static char modparam_fwpostfix[16];
  84 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  85 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  86
  87 static int modparam_hwpctl;
  88 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  89 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  90
  91 static int modparam_nohwcrypt;
  92 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  93 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  94
  95 static int modparam_hwtkip;
  96 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  97 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  98
  99 static int modparam_qos = 1;
 100 module_param_named(qos, modparam_qos, int, 0444);
 101 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 102
 103 static int modparam_btcoex = 1;
 104 module_param_named(btcoex, modparam_btcoex, int, 0444);
 105 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 106
 107 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 108 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 109 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 110
 111 int b43_modparam_pio = B43_PIO_DEFAULT;
 112 module_param_named(pio, b43_modparam_pio, int, 0644);
 113 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 114
 115 static const struct ssb_device_id b43_ssb_tbl[] = {
 116         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 124         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 125         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 126         SSB_DEVTABLE_END
 127 };
 128
 129 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 130
 131 /* Channel and ratetables are shared for all devices.
 132  * They can't be const, because ieee80211 puts some precalculated
 133  * data in there. This data is the same for all devices, so we don't
 134  * get concurrency issues */
 135 #define RATETAB_ENT(_rateid, _flags) \
 136         {                                                               \
 137                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 138                 .hw_value       = (_rateid),                            \
 139                 .flags          = (_flags),                             \
 140         }
 141
 142 /*
 143  * NOTE: When changing this, sync with xmit.c's
 144  *       b43_plcp_get_bitrate_idx_* functions!
 145  */
 146 static struct ieee80211_rate __b43_ratetable[] = {
 147         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 148         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 152         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 153         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 154         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 155         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 156         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 157         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 158         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 159 };
 160
 161 #define b43_a_ratetable         (__b43_ratetable + 4)
 162 #define b43_a_ratetable_size    8
 163 #define b43_b_ratetable         (__b43_ratetable + 0)
 164 #define b43_b_ratetable_size    4
 165 #define b43_g_ratetable         (__b43_ratetable + 0)
 166 #define b43_g_ratetable_size    12
 167
 168 #define CHAN4G(_channel, _freq, _flags) {                       \
 169         .band                   = IEEE80211_BAND_2GHZ,          \
 170         .center_freq            = (_freq),                      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_2ghz_chantable[] = {
 177         CHAN4G(1, 2412, 0),
 178         CHAN4G(2, 2417, 0),
 179         CHAN4G(3, 2422, 0),
 180         CHAN4G(4, 2427, 0),
 181         CHAN4G(5, 2432, 0),
 182         CHAN4G(6, 2437, 0),
 183         CHAN4G(7, 2442, 0),
 184         CHAN4G(8, 2447, 0),
 185         CHAN4G(9, 2452, 0),
 186         CHAN4G(10, 2457, 0),
 187         CHAN4G(11, 2462, 0),
 188         CHAN4G(12, 2467, 0),
 189         CHAN4G(13, 2472, 0),
 190         CHAN4G(14, 2484, 0),
 191 };
 192 #undef CHAN4G
 193
 194 #define CHAN5G(_channel, _flags) {                              \
 195         .band                   = IEEE80211_BAND_5GHZ,          \
 196         .center_freq            = 5000 + (5 * (_channel)),      \
 197         .hw_value               = (_channel),                   \
 198         .flags                  = (_flags),                     \
 199         .max_antenna_gain       = 0,                            \
 200         .max_power              = 30,                           \
 201 }
 202 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 203         CHAN5G(32, 0),          CHAN5G(34, 0),
 204         CHAN5G(36, 0),          CHAN5G(38, 0),
 205         CHAN5G(40, 0),          CHAN5G(42, 0),
 206         CHAN5G(44, 0),          CHAN5G(46, 0),
 207         CHAN5G(48, 0),          CHAN5G(50, 0),
 208         CHAN5G(52, 0),          CHAN5G(54, 0),
 209         CHAN5G(56, 0),          CHAN5G(58, 0),
 210         CHAN5G(60, 0),          CHAN5G(62, 0),
 211         CHAN5G(64, 0),          CHAN5G(66, 0),
 212         CHAN5G(68, 0),          CHAN5G(70, 0),
 213         CHAN5G(72, 0),          CHAN5G(74, 0),
 214         CHAN5G(76, 0),          CHAN5G(78, 0),
 215         CHAN5G(80, 0),          CHAN5G(82, 0),
 216         CHAN5G(84, 0),          CHAN5G(86, 0),
 217         CHAN5G(88, 0),          CHAN5G(90, 0),
 218         CHAN5G(92, 0),          CHAN5G(94, 0),
 219         CHAN5G(96, 0),          CHAN5G(98, 0),
 220         CHAN5G(100, 0),         CHAN5G(102, 0),
 221         CHAN5G(104, 0),         CHAN5G(106, 0),
 222         CHAN5G(108, 0),         CHAN5G(110, 0),
 223         CHAN5G(112, 0),         CHAN5G(114, 0),
 224         CHAN5G(116, 0),         CHAN5G(118, 0),
 225         CHAN5G(120, 0),         CHAN5G(122, 0),
 226         CHAN5G(124, 0),         CHAN5G(126, 0),
 227         CHAN5G(128, 0),         CHAN5G(130, 0),
 228         CHAN5G(132, 0),         CHAN5G(134, 0),
 229         CHAN5G(136, 0),         CHAN5G(138, 0),
 230         CHAN5G(140, 0),         CHAN5G(142, 0),
 231         CHAN5G(144, 0),         CHAN5G(145, 0),
 232         CHAN5G(146, 0),         CHAN5G(147, 0),
 233         CHAN5G(148, 0),         CHAN5G(149, 0),
 234         CHAN5G(150, 0),         CHAN5G(151, 0),
 235         CHAN5G(152, 0),         CHAN5G(153, 0),
 236         CHAN5G(154, 0),         CHAN5G(155, 0),
 237         CHAN5G(156, 0),         CHAN5G(157, 0),
 238         CHAN5G(158, 0),         CHAN5G(159, 0),
 239         CHAN5G(160, 0),         CHAN5G(161, 0),
 240         CHAN5G(162, 0),         CHAN5G(163, 0),
 241         CHAN5G(164, 0),         CHAN5G(165, 0),
 242         CHAN5G(166, 0),         CHAN5G(168, 0),
 243         CHAN5G(170, 0),         CHAN5G(172, 0),
 244         CHAN5G(174, 0),         CHAN5G(176, 0),
 245         CHAN5G(178, 0),         CHAN5G(180, 0),
 246         CHAN5G(182, 0),         CHAN5G(184, 0),
 247         CHAN5G(186, 0),         CHAN5G(188, 0),
 248         CHAN5G(190, 0),         CHAN5G(192, 0),
 249         CHAN5G(194, 0),         CHAN5G(196, 0),
 250         CHAN5G(198, 0),         CHAN5G(200, 0),
 251         CHAN5G(202, 0),         CHAN5G(204, 0),
 252         CHAN5G(206, 0),         CHAN5G(208, 0),
 253         CHAN5G(210, 0),         CHAN5G(212, 0),
 254         CHAN5G(214, 0),         CHAN5G(216, 0),
 255         CHAN5G(218, 0),         CHAN5G(220, 0),
 256         CHAN5G(222, 0),         CHAN5G(224, 0),
 257         CHAN5G(226, 0),         CHAN5G(228, 0),
 258 };
 259
 260 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 261         CHAN5G(34, 0),          CHAN5G(36, 0),
 262         CHAN5G(38, 0),          CHAN5G(40, 0),
 263         CHAN5G(42, 0),          CHAN5G(44, 0),
 264         CHAN5G(46, 0),          CHAN5G(48, 0),
 265         CHAN5G(52, 0),          CHAN5G(56, 0),
 266         CHAN5G(60, 0),          CHAN5G(64, 0),
 267         CHAN5G(100, 0),         CHAN5G(104, 0),
 268         CHAN5G(108, 0),         CHAN5G(112, 0),
 269         CHAN5G(116, 0),         CHAN5G(120, 0),
 270         CHAN5G(124, 0),         CHAN5G(128, 0),
 271         CHAN5G(132, 0),         CHAN5G(136, 0),
 272         CHAN5G(140, 0),         CHAN5G(149, 0),
 273         CHAN5G(153, 0),         CHAN5G(157, 0),
 274         CHAN5G(161, 0),         CHAN5G(165, 0),
 275         CHAN5G(184, 0),         CHAN5G(188, 0),
 276         CHAN5G(192, 0),         CHAN5G(196, 0),
 277         CHAN5G(200, 0),         CHAN5G(204, 0),
 278         CHAN5G(208, 0),         CHAN5G(212, 0),
 279         CHAN5G(216, 0),
 280 };
 281 #undef CHAN5G
 282
 283 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 284         .band           = IEEE80211_BAND_5GHZ,
 285         .channels       = b43_5ghz_nphy_chantable,
 286         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 287         .bitrates       = b43_a_ratetable,
 288         .n_bitrates     = b43_a_ratetable_size,
 289 };
 290
 291 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 292         .band           = IEEE80211_BAND_5GHZ,
 293         .channels       = b43_5ghz_aphy_chantable,
 294         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 295         .bitrates       = b43_a_ratetable,
 296         .n_bitrates     = b43_a_ratetable_size,
 297 };
 298
 299 static struct ieee80211_supported_band b43_band_2GHz = {
 300         .band           = IEEE80211_BAND_2GHZ,
 301         .channels       = b43_2ghz_chantable,
 302         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 303         .bitrates       = b43_g_ratetable,
 304         .n_bitrates     = b43_g_ratetable_size,
 305 };
 306
 307 static void b43_wireless_core_exit(struct b43_wldev *dev);
 308 static int b43_wireless_core_init(struct b43_wldev *dev);
 309 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 310 static int b43_wireless_core_start(struct b43_wldev *dev);
 311
 312 static int b43_ratelimit(struct b43_wl *wl)
 313 {
 314         if (!wl || !wl->current_dev)
 315                 return 1;
 316         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 317                 return 1;
 318         /* We are up and running.
 319          * Ratelimit the messages to avoid DoS over the net. */
 320         return net_ratelimit();
 321 }
 322
 323 void b43info(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 328                 return;
 329         if (!b43_ratelimit(wl))
 330                 return;
 331         va_start(args, fmt);
 332         printk(KERN_INFO "b43-%s: ",
 333                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 334         vprintk(fmt, args);
 335         va_end(args);
 336 }
 337
 338 void b43err(struct b43_wl *wl, const char *fmt, ...)
 339 {
 340         va_list args;
 341
 342         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 343                 return;
 344         if (!b43_ratelimit(wl))
 345                 return;
 346         va_start(args, fmt);
 347         printk(KERN_ERR "b43-%s ERROR: ",
 348                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 349         vprintk(fmt, args);
 350         va_end(args);
 351 }
 352
 353 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 354 {
 355         va_list args;
 356
 357         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 358                 return;
 359         if (!b43_ratelimit(wl))
 360                 return;
 361         va_start(args, fmt);
 362         printk(KERN_WARNING "b43-%s warning: ",
 363                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 364         vprintk(fmt, args);
 365         va_end(args);
 366 }
 367
 368 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 369 {
 370         va_list args;
 371
 372         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 373                 return;
 374         va_start(args, fmt);
 375         printk(KERN_DEBUG "b43-%s debug: ",
 376                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 377         vprintk(fmt, args);
 378         va_end(args);
 379 }
 380
 381 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 382 {
 383         u32 macctl;
 384
 385         B43_WARN_ON(offset % 4 != 0);
 386
 387         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 388         if (macctl & B43_MACCTL_BE)
 389                 val = swab32(val);
 390
 391         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 392         mmiowb();
 393         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 394 }
 395
 396 static inline void b43_shm_control_word(struct b43_wldev *dev,
 397                                         u16 routing, u16 offset)
 398 {
 399         u32 control;
 400
 401         /* "offset" is the WORD offset. */
 402         control = routing;
 403         control <<= 16;
 404         control |= offset;
 405         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 406 }
 407
 408 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 409 {
 410         u32 ret;
 411
 412         if (routing == B43_SHM_SHARED) {
 413                 B43_WARN_ON(offset & 0x0001);
 414                 if (offset & 0x0003) {
 415                         /* Unaligned access */
 416                         b43_shm_control_word(dev, routing, offset >> 2);
 417                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 418                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 419                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 420
 421                         goto out;
 422                 }
 423                 offset >>= 2;
 424         }
 425         b43_shm_control_word(dev, routing, offset);
 426         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 427 out:
 428         return ret;
 429 }
 430
 431 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 432 {
 433         u16 ret;
 434
 435         if (routing == B43_SHM_SHARED) {
 436                 B43_WARN_ON(offset & 0x0001);
 437                 if (offset & 0x0003) {
 438                         /* Unaligned access */
 439                         b43_shm_control_word(dev, routing, offset >> 2);
 440                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 441
 442                         goto out;
 443                 }
 444                 offset >>= 2;
 445         }
 446         b43_shm_control_word(dev, routing, offset);
 447         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 448 out:
 449         return ret;
 450 }
 451
 452 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 453 {
 454         if (routing == B43_SHM_SHARED) {
 455                 B43_WARN_ON(offset & 0x0001);
 456                 if (offset & 0x0003) {
 457                         /* Unaligned access */
 458                         b43_shm_control_word(dev, routing, offset >> 2);
 459                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 460                                     value & 0xFFFF);
 461                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 462                         b43_write16(dev, B43_MMIO_SHM_DATA,
 463                                     (value >> 16) & 0xFFFF);
 464                         return;
 465                 }
 466                 offset >>= 2;
 467         }
 468         b43_shm_control_word(dev, routing, offset);
 469         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 470 }
 471
 472 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 473 {
 474         if (routing == B43_SHM_SHARED) {
 475                 B43_WARN_ON(offset & 0x0001);
 476                 if (offset & 0x0003) {
 477                         /* Unaligned access */
 478                         b43_shm_control_word(dev, routing, offset >> 2);
 479                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 480                         return;
 481                 }
 482                 offset >>= 2;
 483         }
 484         b43_shm_control_word(dev, routing, offset);
 485         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 486 }
 487
 488 /* Read HostFlags */
 489 u64 b43_hf_read(struct b43_wldev *dev)
 490 {
 491         u64 ret;
 492
 493         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 494         ret <<= 16;
 495         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 496         ret <<= 16;
 497         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 498
 499         return ret;
 500 }
 501
 502 /* Write HostFlags */
 503 void b43_hf_write(struct b43_wldev *dev, u64 value)
 504 {
 505         u16 lo, mi, hi;
 506
 507         lo = (value & 0x00000000FFFFULL);
 508         mi = (value & 0x0000FFFF0000ULL) >> 16;
 509         hi = (value & 0xFFFF00000000ULL) >> 32;
 510         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 511         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 512         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 513 }
 514
 515 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 516 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 517 {
 518         B43_WARN_ON(!dev->fw.opensource);
 519         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 520 }
 521
 522 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 523 {
 524         u32 low, high;
 525
 526         B43_WARN_ON(dev->dev->id.revision < 3);
 527
 528         /* The hardware guarantees us an atomic read, if we
 529          * read the low register first. */
 530         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 531         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 532
 533         *tsf = high;
 534         *tsf <<= 32;
 535         *tsf |= low;
 536 }
 537
 538 static void b43_time_lock(struct b43_wldev *dev)
 539 {
 540         u32 macctl;
 541
 542         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 543         macctl |= B43_MACCTL_TBTTHOLD;
 544         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 545         /* Commit the write */
 546         b43_read32(dev, B43_MMIO_MACCTL);
 547 }
 548
 549 static void b43_time_unlock(struct b43_wldev *dev)
 550 {
 551         u32 macctl;
 552
 553         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 554         macctl &= ~B43_MACCTL_TBTTHOLD;
 555         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 556         /* Commit the write */
 557         b43_read32(dev, B43_MMIO_MACCTL);
 558 }
 559
 560 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 561 {
 562         u32 low, high;
 563
 564         B43_WARN_ON(dev->dev->id.revision < 3);
 565
 566         low = tsf;
 567         high = (tsf >> 32);
 568         /* The hardware guarantees us an atomic write, if we
 569          * write the low register first. */
 570         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 571         mmiowb();
 572         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 573         mmiowb();
 574 }
 575
 576 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 577 {
 578         b43_time_lock(dev);
 579         b43_tsf_write_locked(dev, tsf);
 580         b43_time_unlock(dev);
 581 }
 582
 583 static
 584 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 585 {
 586         static const u8 zero_addr[ETH_ALEN] = { 0 };
 587         u16 data;
 588
 589         if (!mac)
 590                 mac = zero_addr;
 591
 592         offset |= 0x0020;
 593         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 594
 595         data = mac[0];
 596         data |= mac[1] << 8;
 597         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 598         data = mac[2];
 599         data |= mac[3] << 8;
 600         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 601         data = mac[4];
 602         data |= mac[5] << 8;
 603         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 604 }
 605
 606 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 607 {
 608         const u8 *mac;
 609         const u8 *bssid;
 610         u8 mac_bssid[ETH_ALEN * 2];
 611         int i;
 612         u32 tmp;
 613
 614         bssid = dev->wl->bssid;
 615         mac = dev->wl->mac_addr;
 616
 617         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 618
 619         memcpy(mac_bssid, mac, ETH_ALEN);
 620         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 621
 622         /* Write our MAC address and BSSID to template ram */
 623         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 624                 tmp = (u32) (mac_bssid[i + 0]);
 625                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 626                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 627                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 628                 b43_ram_write(dev, 0x20 + i, tmp);
 629         }
 630 }
 631
 632 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 633 {
 634         b43_write_mac_bssid_templates(dev);
 635         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 636 }
 637
 638 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 639 {
 640         /* slot_time is in usec. */
 641         /* This test used to exit for all but a G PHY. */
 642         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 643                 return;
 644         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 645         /* Shared memory location 0x0010 is the slot time and should be
 646          * set to slot_time; however, this register is initially 0 and changing
 647          * the value adversely affects the transmit rate for BCM4311
 648          * devices. Until this behavior is unterstood, delete this step
 649          *
 650          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 651          */
 652 }
 653
 654 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 655 {
 656         b43_set_slot_time(dev, 9);
 657 }
 658
 659 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 660 {
 661         b43_set_slot_time(dev, 20);
 662 }
 663
 664 /* DummyTransmission function, as documented on
 665  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 666  */
 667 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 668 {
 669         struct b43_phy *phy = &dev->phy;
 670         unsigned int i, max_loop;
 671         u16 value;
 672         u32 buffer[5] = {
 673                 0x00000000,
 674                 0x00D40000,
 675                 0x00000000,
 676                 0x01000000,
 677                 0x00000000,
 678         };
 679
 680         if (ofdm) {
 681                 max_loop = 0x1E;
 682                 buffer[0] = 0x000201CC;
 683         } else {
 684                 max_loop = 0xFA;
 685                 buffer[0] = 0x000B846E;
 686         }
 687
 688         for (i = 0; i < 5; i++)
 689                 b43_ram_write(dev, i * 4, buffer[i]);
 690
 691         b43_write16(dev, 0x0568, 0x0000);
 692         if (dev->dev->id.revision < 11)
 693                 b43_write16(dev, 0x07C0, 0x0000);
 694         else
 695                 b43_write16(dev, 0x07C0, 0x0100);
 696         value = (ofdm ? 0x41 : 0x40);
 697         b43_write16(dev, 0x050C, value);
 698         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 699                 b43_write16(dev, 0x0514, 0x1A02);
 700         b43_write16(dev, 0x0508, 0x0000);
 701         b43_write16(dev, 0x050A, 0x0000);
 702         b43_write16(dev, 0x054C, 0x0000);
 703         b43_write16(dev, 0x056A, 0x0014);
 704         b43_write16(dev, 0x0568, 0x0826);
 705         b43_write16(dev, 0x0500, 0x0000);
 706         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 707                 //SPEC TODO
 708         }
 709
 710         switch (phy->type) {
 711         case B43_PHYTYPE_N:
 712                 b43_write16(dev, 0x0502, 0x00D0);
 713                 break;
 714         case B43_PHYTYPE_LP:
 715                 b43_write16(dev, 0x0502, 0x0050);
 716                 break;
 717         default:
 718                 b43_write16(dev, 0x0502, 0x0030);
 719         }
 720
 721         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 722                 b43_radio_write16(dev, 0x0051, 0x0017);
 723         for (i = 0x00; i < max_loop; i++) {
 724                 value = b43_read16(dev, 0x050E);
 725                 if (value & 0x0080)
 726                         break;
 727                 udelay(10);
 728         }
 729         for (i = 0x00; i < 0x0A; i++) {
 730                 value = b43_read16(dev, 0x050E);
 731                 if (value & 0x0400)
 732                         break;
 733                 udelay(10);
 734         }
 735         for (i = 0x00; i < 0x19; i++) {
 736                 value = b43_read16(dev, 0x0690);
 737                 if (!(value & 0x0100))
 738                         break;
 739                 udelay(10);
 740         }
 741         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 742                 b43_radio_write16(dev, 0x0051, 0x0037);
 743 }
 744
 745 static void key_write(struct b43_wldev *dev,
 746                       u8 index, u8 algorithm, const u8 *key)
 747 {
 748         unsigned int i;
 749         u32 offset;
 750         u16 value;
 751         u16 kidx;
 752
 753         /* Key index/algo block */
 754         kidx = b43_kidx_to_fw(dev, index);
 755         value = ((kidx << 4) | algorithm);
 756         b43_shm_write16(dev, B43_SHM_SHARED,
 757                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 758
 759         /* Write the key to the Key Table Pointer offset */
 760         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 761         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 762                 value = key[i];
 763                 value |= (u16) (key[i + 1]) << 8;
 764                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 765         }
 766 }
 767
 768 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 769 {
 770         u32 addrtmp[2] = { 0, 0, };
 771         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 772
 773         if (b43_new_kidx_api(dev))
 774                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 775
 776         B43_WARN_ON(index < pairwise_keys_start);
 777         /* We have four default TX keys and possibly four default RX keys.
 778          * Physical mac 0 is mapped to physical key 4 or 8, depending
 779          * on the firmware version.
 780          * So we must adjust the index here.
 781          */
 782         index -= pairwise_keys_start;
 783         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 784
 785         if (addr) {
 786                 addrtmp[0] = addr[0];
 787                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 788                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 789                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 790                 addrtmp[1] = addr[4];
 791                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 792         }
 793
 794         /* Receive match transmitter address (RCMTA) mechanism */
 795         b43_shm_write32(dev, B43_SHM_RCMTA,
 796                         (index * 2) + 0, addrtmp[0]);
 797         b43_shm_write16(dev, B43_SHM_RCMTA,
 798                         (index * 2) + 1, addrtmp[1]);
 799 }
 800
 801 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 802  * When a packet is received, the iv32 is checked.
 803  * - if it doesn't the packet is returned without modification (and software
 804  *   decryption can be done). That's what happen when iv16 wrap.
 805  * - if it does, the rc4 key is computed, and decryption is tried.
 806  *   Either it will success and B43_RX_MAC_DEC is returned,
 807  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 808  *   and the packet is not usable (it got modified by the ucode).
 809  * So in order to never have B43_RX_MAC_DECERR, we should provide
 810  * a iv32 and phase1key that match. Because we drop packets in case of
 811  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 812  * packets will be lost without higher layer knowing (ie no resync possible
 813  * until next wrap).
 814  *
 815  * NOTE : this should support 50 key like RCMTA because
 816  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 817  */
 818 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 819                 u16 *phase1key)
 820 {
 821         unsigned int i;
 822         u32 offset;
 823         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 824
 825         if (!modparam_hwtkip)
 826                 return;
 827
 828         if (b43_new_kidx_api(dev))
 829                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 830
 831         B43_WARN_ON(index < pairwise_keys_start);
 832         /* We have four default TX keys and possibly four default RX keys.
 833          * Physical mac 0 is mapped to physical key 4 or 8, depending
 834          * on the firmware version.
 835          * So we must adjust the index here.
 836          */
 837         index -= pairwise_keys_start;
 838         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 839
 840         if (b43_debug(dev, B43_DBG_KEYS)) {
 841                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 842                                 index, iv32);
 843         }
 844         /* Write the key to the  RX tkip shared mem */
 845         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 846         for (i = 0; i < 10; i += 2) {
 847                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 848                                 phase1key ? phase1key[i / 2] : 0);
 849         }
 850         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 851         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 852 }
 853
 854 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 855                                    struct ieee80211_vif *vif,
 856                                    struct ieee80211_key_conf *keyconf,
 857                                    struct ieee80211_sta *sta,
 858                                    u32 iv32, u16 *phase1key)
 859 {
 860         struct b43_wl *wl = hw_to_b43_wl(hw);
 861         struct b43_wldev *dev;
 862         int index = keyconf->hw_key_idx;
 863
 864         if (B43_WARN_ON(!modparam_hwtkip))
 865                 return;
 866
 867         /* This is only called from the RX path through mac80211, where
 868          * our mutex is already locked. */
 869         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 870         dev = wl->current_dev;
 871         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 872
 873         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 874
 875         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 876         /* only pairwise TKIP keys are supported right now */
 877         if (WARN_ON(!sta))
 878                 return;
 879         keymac_write(dev, index, sta->addr);
 880 }
 881
 882 static void do_key_write(struct b43_wldev *dev,
 883                          u8 index, u8 algorithm,
 884                          const u8 *key, size_t key_len, const u8 *mac_addr)
 885 {
 886         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 887         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 888
 889         if (b43_new_kidx_api(dev))
 890                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 891
 892         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 893         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 894
 895         if (index >= pairwise_keys_start)
 896                 keymac_write(dev, index, NULL); /* First zero out mac. */
 897         if (algorithm == B43_SEC_ALGO_TKIP) {
 898                 /*
 899                  * We should provide an initial iv32, phase1key pair.
 900                  * We could start with iv32=0 and compute the corresponding
 901                  * phase1key, but this means calling ieee80211_get_tkip_key
 902                  * with a fake skb (or export other tkip function).
 903                  * Because we are lazy we hope iv32 won't start with
 904                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 905                  * correct pair.
 906                  */
 907                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 908         } else if (index >= pairwise_keys_start) /* clear it */
 909                 rx_tkip_phase1_write(dev, index, 0, NULL);
 910         if (key)
 911                 memcpy(buf, key, key_len);
 912         key_write(dev, index, algorithm, buf);
 913         if (index >= pairwise_keys_start)
 914                 keymac_write(dev, index, mac_addr);
 915
 916         dev->key[index].algorithm = algorithm;
 917 }
 918
 919 static int b43_key_write(struct b43_wldev *dev,
 920                          int index, u8 algorithm,
 921                          const u8 *key, size_t key_len,
 922                          const u8 *mac_addr,
 923                          struct ieee80211_key_conf *keyconf)
 924 {
 925         int i;
 926         int pairwise_keys_start;
 927
 928         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 929          *      - Temporal Encryption Key (128 bits)
 930          *      - Temporal Authenticator Tx MIC Key (64 bits)
 931          *      - Temporal Authenticator Rx MIC Key (64 bits)
 932          *
 933          *      Hardware only store TEK
 934          */
 935         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 936                 key_len = 16;
 937         if (key_len > B43_SEC_KEYSIZE)
 938                 return -EINVAL;
 939         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 940                 /* Check that we don't already have this key. */
 941                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 942         }
 943         if (index < 0) {
 944                 /* Pairwise key. Get an empty slot for the key. */
 945                 if (b43_new_kidx_api(dev))
 946                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 947                 else
 948                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 949                 for (i = pairwise_keys_start;
 950                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 951                      i++) {
 952                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 953                         if (!dev->key[i].keyconf) {
 954                                 /* found empty */
 955                                 index = i;
 956                                 break;
 957                         }
 958                 }
 959                 if (index < 0) {
 960                         b43warn(dev->wl, "Out of hardware key memory\n");
 961                         return -ENOSPC;
 962                 }
 963         } else
 964                 B43_WARN_ON(index > 3);
 965
 966         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 967         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 968                 /* Default RX key */
 969                 B43_WARN_ON(mac_addr);
 970                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 971         }
 972         keyconf->hw_key_idx = index;
 973         dev->key[index].keyconf = keyconf;
 974
 975         return 0;
 976 }
 977
 978 static int b43_key_clear(struct b43_wldev *dev, int index)
 979 {
 980         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 981                 return -EINVAL;
 982         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 983                      NULL, B43_SEC_KEYSIZE, NULL);
 984         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 985                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 986                              NULL, B43_SEC_KEYSIZE, NULL);
 987         }
 988         dev->key[index].keyconf = NULL;
 989
 990         return 0;
 991 }
 992
 993 static void b43_clear_keys(struct b43_wldev *dev)
 994 {
 995         int i, count;
 996
 997         if (b43_new_kidx_api(dev))
 998                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 999         else
1000                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1001         for (i = 0; i < count; i++)
1002                 b43_key_clear(dev, i);
1003 }
1004
1005 static void b43_dump_keymemory(struct b43_wldev *dev)
1006 {
1007         unsigned int i, index, count, offset, pairwise_keys_start;
1008         u8 mac[ETH_ALEN];
1009         u16 algo;
1010         u32 rcmta0;
1011         u16 rcmta1;
1012         u64 hf;
1013         struct b43_key *key;
1014
1015         if (!b43_debug(dev, B43_DBG_KEYS))
1016                 return;
1017
1018         hf = b43_hf_read(dev);
1019         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1020                !!(hf & B43_HF_USEDEFKEYS));
1021         if (b43_new_kidx_api(dev)) {
1022                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1023                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1024         } else {
1025                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1026                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1027         }
1028         for (index = 0; index < count; index++) {
1029                 key = &(dev->key[index]);
1030                 printk(KERN_DEBUG "Key slot %02u: %s",
1031                        index, (key->keyconf == NULL) ? " " : "*");
1032                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1033                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1034                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1035                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1036                 }
1037
1038                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1040                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1041
1042                 if (index >= pairwise_keys_start) {
1043                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1044                                 printk("   TKIP: ");
1045                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1046                                 for (i = 0; i < 14; i += 2) {
1047                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1048                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1049                                 }
1050                         }
1051                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1052                                                 ((index - pairwise_keys_start) * 2) + 0);
1053                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1054                                                 ((index - pairwise_keys_start) * 2) + 1);
1055                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1056                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1057                         printk("   MAC: %pM", mac);
1058                 } else
1059                         printk("   DEFAULT KEY");
1060                 printk("\n");
1061         }
1062 }
1063
1064 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1065 {
1066         u32 macctl;
1067         u16 ucstat;
1068         bool hwps;
1069         bool awake;
1070         int i;
1071
1072         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1073                     (ps_flags & B43_PS_DISABLED));
1074         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1075
1076         if (ps_flags & B43_PS_ENABLED) {
1077                 hwps = 1;
1078         } else if (ps_flags & B43_PS_DISABLED) {
1079                 hwps = 0;
1080         } else {
1081                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1082                 //      and thus is not an AP and we are associated, set bit 25
1083         }
1084         if (ps_flags & B43_PS_AWAKE) {
1085                 awake = 1;
1086         } else if (ps_flags & B43_PS_ASLEEP) {
1087                 awake = 0;
1088         } else {
1089                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1090                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1091                 //      successful, set bit26
1092         }
1093
1094 /* FIXME: For now we force awake-on and hwps-off */
1095         hwps = 0;
1096         awake = 1;
1097
1098         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1099         if (hwps)
1100                 macctl |= B43_MACCTL_HWPS;
1101         else
1102                 macctl &= ~B43_MACCTL_HWPS;
1103         if (awake)
1104                 macctl |= B43_MACCTL_AWAKE;
1105         else
1106                 macctl &= ~B43_MACCTL_AWAKE;
1107         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1108         /* Commit write */
1109         b43_read32(dev, B43_MMIO_MACCTL);
1110         if (awake && dev->dev->id.revision >= 5) {
1111                 /* Wait for the microcode to wake up. */
1112                 for (i = 0; i < 100; i++) {
1113                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1114                                                 B43_SHM_SH_UCODESTAT);
1115                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1116                                 break;
1117                         udelay(10);
1118                 }
1119         }
1120 }
1121
1122 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1123 {
1124         u32 tmslow;
1125         u32 macctl;
1126
1127         flags |= B43_TMSLOW_PHYCLKEN;
1128         flags |= B43_TMSLOW_PHYRESET;
1129         ssb_device_enable(dev->dev, flags);
1130         msleep(2);              /* Wait for the PLL to turn on. */
1131
1132         /* Now take the PHY out of Reset again */
1133         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1134         tmslow |= SSB_TMSLOW_FGC;
1135         tmslow &= ~B43_TMSLOW_PHYRESET;
1136         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1137         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1138         msleep(1);
1139         tmslow &= ~SSB_TMSLOW_FGC;
1140         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1141         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1142         msleep(1);
1143
1144         /* Turn Analog ON, but only if we already know the PHY-type.
1145          * This protects against very early setup where we don't know the
1146          * PHY-type, yet. wireless_core_reset will be called once again later,
1147          * when we know the PHY-type. */
1148         if (dev->phy.ops)
1149                 dev->phy.ops->switch_analog(dev, 1);
1150
1151         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1152         macctl &= ~B43_MACCTL_GMODE;
1153         if (flags & B43_TMSLOW_GMODE)
1154                 macctl |= B43_MACCTL_GMODE;
1155         macctl |= B43_MACCTL_IHR_ENABLED;
1156         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1157 }
1158
1159 static void handle_irq_transmit_status(struct b43_wldev *dev)
1160 {
1161         u32 v0, v1;
1162         u16 tmp;
1163         struct b43_txstatus stat;
1164
1165         while (1) {
1166                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1167                 if (!(v0 & 0x00000001))
1168                         break;
1169                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1170
1171                 stat.cookie = (v0 >> 16);
1172                 stat.seq = (v1 & 0x0000FFFF);
1173                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1174                 tmp = (v0 & 0x0000FFFF);
1175                 stat.frame_count = ((tmp & 0xF000) >> 12);
1176                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1177                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1178                 stat.pm_indicated = !!(tmp & 0x0080);
1179                 stat.intermediate = !!(tmp & 0x0040);
1180                 stat.for_ampdu = !!(tmp & 0x0020);
1181                 stat.acked = !!(tmp & 0x0002);
1182
1183                 b43_handle_txstatus(dev, &stat);
1184         }
1185 }
1186
1187 static void drain_txstatus_queue(struct b43_wldev *dev)
1188 {
1189         u32 dummy;
1190
1191         if (dev->dev->id.revision < 5)
1192                 return;
1193         /* Read all entries from the microcode TXstatus FIFO
1194          * and throw them away.
1195          */
1196         while (1) {
1197                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1198                 if (!(dummy & 0x00000001))
1199                         break;
1200                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1201         }
1202 }
1203
1204 static u32 b43_jssi_read(struct b43_wldev *dev)
1205 {
1206         u32 val = 0;
1207
1208         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1209         val <<= 16;
1210         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1211
1212         return val;
1213 }
1214
1215 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1216 {
1217         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1218         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1219 }
1220
1221 static void b43_generate_noise_sample(struct b43_wldev *dev)
1222 {
1223         b43_jssi_write(dev, 0x7F7F7F7F);
1224         b43_write32(dev, B43_MMIO_MACCMD,
1225                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1226 }
1227
1228 static void b43_calculate_link_quality(struct b43_wldev *dev)
1229 {
1230         /* Top half of Link Quality calculation. */
1231
1232         if (dev->phy.type != B43_PHYTYPE_G)
1233                 return;
1234         if (dev->noisecalc.calculation_running)
1235                 return;
1236         dev->noisecalc.calculation_running = 1;
1237         dev->noisecalc.nr_samples = 0;
1238
1239         b43_generate_noise_sample(dev);
1240 }
1241
1242 static void handle_irq_noise(struct b43_wldev *dev)
1243 {
1244         struct b43_phy_g *phy = dev->phy.g;
1245         u16 tmp;
1246         u8 noise[4];
1247         u8 i, j;
1248         s32 average;
1249
1250         /* Bottom half of Link Quality calculation. */
1251
1252         if (dev->phy.type != B43_PHYTYPE_G)
1253                 return;
1254
1255         /* Possible race condition: It might be possible that the user
1256          * changed to a different channel in the meantime since we
1257          * started the calculation. We ignore that fact, since it's
1258          * not really that much of a problem. The background noise is
1259          * an estimation only anyway. Slightly wrong results will get damped
1260          * by the averaging of the 8 sample rounds. Additionally the
1261          * value is shortlived. So it will be replaced by the next noise
1262          * calculation round soon. */
1263
1264         B43_WARN_ON(!dev->noisecalc.calculation_running);
1265         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1266         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1267             noise[2] == 0x7F || noise[3] == 0x7F)
1268                 goto generate_new;
1269
1270         /* Get the noise samples. */
1271         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1272         i = dev->noisecalc.nr_samples;
1273         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1274         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1275         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1276         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1277         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1278         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1279         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1280         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1281         dev->noisecalc.nr_samples++;
1282         if (dev->noisecalc.nr_samples == 8) {
1283                 /* Calculate the Link Quality by the noise samples. */
1284                 average = 0;
1285                 for (i = 0; i < 8; i++) {
1286                         for (j = 0; j < 4; j++)
1287                                 average += dev->noisecalc.samples[i][j];
1288                 }
1289                 average /= (8 * 4);
1290                 average *= 125;
1291                 average += 64;
1292                 average /= 128;
1293                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1294                 tmp = (tmp / 128) & 0x1F;
1295                 if (tmp >= 8)
1296                         average += 2;
1297                 else
1298                         average -= 25;
1299                 if (tmp == 8)
1300                         average -= 72;
1301                 else
1302                         average -= 48;
1303
1304                 dev->stats.link_noise = average;
1305                 dev->noisecalc.calculation_running = 0;
1306                 return;
1307         }
1308 generate_new:
1309         b43_generate_noise_sample(dev);
1310 }
1311
1312 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1313 {
1314         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1315                 ///TODO: PS TBTT
1316         } else {
1317                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1318                         b43_power_saving_ctl_bits(dev, 0);
1319         }
1320         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1321                 dev->dfq_valid = 1;
1322 }
1323
1324 static void handle_irq_atim_end(struct b43_wldev *dev)
1325 {
1326         if (dev->dfq_valid) {
1327                 b43_write32(dev, B43_MMIO_MACCMD,
1328                             b43_read32(dev, B43_MMIO_MACCMD)
1329                             | B43_MACCMD_DFQ_VALID);
1330                 dev->dfq_valid = 0;
1331         }
1332 }
1333
1334 static void handle_irq_pmq(struct b43_wldev *dev)
1335 {
1336         u32 tmp;
1337
1338         //TODO: AP mode.
1339
1340         while (1) {
1341                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1342                 if (!(tmp & 0x00000008))
1343                         break;
1344         }
1345         /* 16bit write is odd, but correct. */
1346         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1347 }
1348
1349 static void b43_write_template_common(struct b43_wldev *dev,
1350                                       const u8 *data, u16 size,
1351                                       u16 ram_offset,
1352                                       u16 shm_size_offset, u8 rate)
1353 {
1354         u32 i, tmp;
1355         struct b43_plcp_hdr4 plcp;
1356
1357         plcp.data = 0;
1358         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1359         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1360         ram_offset += sizeof(u32);
1361         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1362          * So leave the first two bytes of the next write blank.
1363          */
1364         tmp = (u32) (data[0]) << 16;
1365         tmp |= (u32) (data[1]) << 24;
1366         b43_ram_write(dev, ram_offset, tmp);
1367         ram_offset += sizeof(u32);
1368         for (i = 2; i < size; i += sizeof(u32)) {
1369                 tmp = (u32) (data[i + 0]);
1370                 if (i + 1 < size)
1371                         tmp |= (u32) (data[i + 1]) << 8;
1372                 if (i + 2 < size)
1373                         tmp |= (u32) (data[i + 2]) << 16;
1374                 if (i + 3 < size)
1375                         tmp |= (u32) (data[i + 3]) << 24;
1376                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1377         }
1378         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1379                         size + sizeof(struct b43_plcp_hdr6));
1380 }
1381
1382 /* Check if the use of the antenna that ieee80211 told us to
1383  * use is possible. This will fall back to DEFAULT.
1384  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1385 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1386                                   u8 antenna_nr)
1387 {
1388         u8 antenna_mask;
1389
1390         if (antenna_nr == 0) {
1391                 /* Zero means "use default antenna". That's always OK. */
1392                 return 0;
1393         }
1394
1395         /* Get the mask of available antennas. */
1396         if (dev->phy.gmode)
1397                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1398         else
1399                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1400
1401         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1402                 /* This antenna is not available. Fall back to default. */
1403                 return 0;
1404         }
1405
1406         return antenna_nr;
1407 }
1408
1409 /* Convert a b43 antenna number value to the PHY TX control value. */
1410 static u16 b43_antenna_to_phyctl(int antenna)
1411 {
1412         switch (antenna) {
1413         case B43_ANTENNA0:
1414                 return B43_TXH_PHY_ANT0;
1415         case B43_ANTENNA1:
1416                 return B43_TXH_PHY_ANT1;
1417         case B43_ANTENNA2:
1418                 return B43_TXH_PHY_ANT2;
1419         case B43_ANTENNA3:
1420                 return B43_TXH_PHY_ANT3;
1421         case B43_ANTENNA_AUTO0:
1422         case B43_ANTENNA_AUTO1:
1423                 return B43_TXH_PHY_ANT01AUTO;
1424         }
1425         B43_WARN_ON(1);
1426         return 0;
1427 }
1428
1429 static void b43_write_beacon_template(struct b43_wldev *dev,
1430                                       u16 ram_offset,
1431                                       u16 shm_size_offset)
1432 {
1433         unsigned int i, len, variable_len;
1434         const struct ieee80211_mgmt *bcn;
1435         const u8 *ie;
1436         bool tim_found = 0;
1437         unsigned int rate;
1438         u16 ctl;
1439         int antenna;
1440         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1441
1442         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1443         len = min((size_t) dev->wl->current_beacon->len,
1444                   0x200 - sizeof(struct b43_plcp_hdr6));
1445         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1446
1447         b43_write_template_common(dev, (const u8 *)bcn,
1448                                   len, ram_offset, shm_size_offset, rate);
1449
1450         /* Write the PHY TX control parameters. */
1451         antenna = B43_ANTENNA_DEFAULT;
1452         antenna = b43_antenna_to_phyctl(antenna);
1453         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1454         /* We can't send beacons with short preamble. Would get PHY errors. */
1455         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1456         ctl &= ~B43_TXH_PHY_ANT;
1457         ctl &= ~B43_TXH_PHY_ENC;
1458         ctl |= antenna;
1459         if (b43_is_cck_rate(rate))
1460                 ctl |= B43_TXH_PHY_ENC_CCK;
1461         else
1462                 ctl |= B43_TXH_PHY_ENC_OFDM;
1463         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1464
1465         /* Find the position of the TIM and the DTIM_period value
1466          * and write them to SHM. */
1467         ie = bcn->u.beacon.variable;
1468         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1469         for (i = 0; i < variable_len - 2; ) {
1470                 uint8_t ie_id, ie_len;
1471
1472                 ie_id = ie[i];
1473                 ie_len = ie[i + 1];
1474                 if (ie_id == 5) {
1475                         u16 tim_position;
1476                         u16 dtim_period;
1477                         /* This is the TIM Information Element */
1478
1479                         /* Check whether the ie_len is in the beacon data range. */
1480                         if (variable_len < ie_len + 2 + i)
1481                                 break;
1482                         /* A valid TIM is at least 4 bytes long. */
1483                         if (ie_len < 4)
1484                                 break;
1485                         tim_found = 1;
1486
1487                         tim_position = sizeof(struct b43_plcp_hdr6);
1488                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1489                         tim_position += i;
1490
1491                         dtim_period = ie[i + 3];
1492
1493                         b43_shm_write16(dev, B43_SHM_SHARED,
1494                                         B43_SHM_SH_TIMBPOS, tim_position);
1495                         b43_shm_write16(dev, B43_SHM_SHARED,
1496                                         B43_SHM_SH_DTIMPER, dtim_period);
1497                         break;
1498                 }
1499                 i += ie_len + 2;
1500         }
1501         if (!tim_found) {
1502                 /*
1503                  * If ucode wants to modify TIM do it behind the beacon, this
1504                  * will happen, for example, when doing mesh networking.
1505                  */
1506                 b43_shm_write16(dev, B43_SHM_SHARED,
1507                                 B43_SHM_SH_TIMBPOS,
1508                                 len + sizeof(struct b43_plcp_hdr6));
1509                 b43_shm_write16(dev, B43_SHM_SHARED,
1510                                 B43_SHM_SH_DTIMPER, 0);
1511         }
1512         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1513 }
1514
1515 static void b43_upload_beacon0(struct b43_wldev *dev)
1516 {
1517         struct b43_wl *wl = dev->wl;
1518
1519         if (wl->beacon0_uploaded)
1520                 return;
1521         b43_write_beacon_template(dev, 0x68, 0x18);
1522         wl->beacon0_uploaded = 1;
1523 }
1524
1525 static void b43_upload_beacon1(struct b43_wldev *dev)
1526 {
1527         struct b43_wl *wl = dev->wl;
1528
1529         if (wl->beacon1_uploaded)
1530                 return;
1531         b43_write_beacon_template(dev, 0x468, 0x1A);
1532         wl->beacon1_uploaded = 1;
1533 }
1534
1535 static void handle_irq_beacon(struct b43_wldev *dev)
1536 {
1537         struct b43_wl *wl = dev->wl;
1538         u32 cmd, beacon0_valid, beacon1_valid;
1539
1540         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1541             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1542                 return;
1543
1544         /* This is the bottom half of the asynchronous beacon update. */
1545
1546         /* Ignore interrupt in the future. */
1547         dev->irq_mask &= ~B43_IRQ_BEACON;
1548
1549         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1550         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1551         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1552
1553         /* Schedule interrupt manually, if busy. */
1554         if (beacon0_valid && beacon1_valid) {
1555                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1556                 dev->irq_mask |= B43_IRQ_BEACON;
1557                 return;
1558         }
1559
1560         if (unlikely(wl->beacon_templates_virgin)) {
1561                 /* We never uploaded a beacon before.
1562                  * Upload both templates now, but only mark one valid. */
1563                 wl->beacon_templates_virgin = 0;
1564                 b43_upload_beacon0(dev);
1565                 b43_upload_beacon1(dev);
1566                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1567                 cmd |= B43_MACCMD_BEACON0_VALID;
1568                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1569         } else {
1570                 if (!beacon0_valid) {
1571                         b43_upload_beacon0(dev);
1572                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1573                         cmd |= B43_MACCMD_BEACON0_VALID;
1574                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1575                 } else if (!beacon1_valid) {
1576                         b43_upload_beacon1(dev);
1577                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1578                         cmd |= B43_MACCMD_BEACON1_VALID;
1579                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1580                 }
1581         }
1582 }
1583
1584 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1585 {
1586         u32 old_irq_mask = dev->irq_mask;
1587
1588         /* update beacon right away or defer to irq */
1589         handle_irq_beacon(dev);
1590         if (old_irq_mask != dev->irq_mask) {
1591                 /* The handler updated the IRQ mask. */
1592                 B43_WARN_ON(!dev->irq_mask);
1593                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1594                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1595                 } else {
1596                         /* Device interrupts are currently disabled. That means
1597                          * we just ran the hardirq handler and scheduled the
1598                          * IRQ thread. The thread will write the IRQ mask when
1599                          * it finished, so there's nothing to do here. Writing
1600                          * the mask _here_ would incorrectly re-enable IRQs. */
1601                 }
1602         }
1603 }
1604
1605 static void b43_beacon_update_trigger_work(struct work_struct *work)
1606 {
1607         struct b43_wl *wl = container_of(work, struct b43_wl,
1608                                          beacon_update_trigger);
1609         struct b43_wldev *dev;
1610
1611         mutex_lock(&wl->mutex);
1612         dev = wl->current_dev;
1613         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1614                 if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
1615                         /* wl->mutex is enough. */
1616                         b43_do_beacon_update_trigger_work(dev);
1617                         mmiowb();
1618                 } else {
1619                         spin_lock_irq(&wl->hardirq_lock);
1620                         b43_do_beacon_update_trigger_work(dev);
1621                         mmiowb();
1622                         spin_unlock_irq(&wl->hardirq_lock);
1623                 }
1624         }
1625         mutex_unlock(&wl->mutex);
1626 }
1627
1628 /* Asynchronously update the packet templates in template RAM.
1629  * Locking: Requires wl->mutex to be locked. */
1630 static void b43_update_templates(struct b43_wl *wl)
1631 {
1632         struct sk_buff *beacon;
1633
1634         /* This is the top half of the ansynchronous beacon update.
1635          * The bottom half is the beacon IRQ.
1636          * Beacon update must be asynchronous to avoid sending an
1637          * invalid beacon. This can happen for example, if the firmware
1638          * transmits a beacon while we are updating it. */
1639
1640         /* We could modify the existing beacon and set the aid bit in
1641          * the TIM field, but that would probably require resizing and
1642          * moving of data within the beacon template.
1643          * Simply request a new beacon and let mac80211 do the hard work. */
1644         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1645         if (unlikely(!beacon))
1646                 return;
1647
1648         if (wl->current_beacon)
1649                 dev_kfree_skb_any(wl->current_beacon);
1650         wl->current_beacon = beacon;
1651         wl->beacon0_uploaded = 0;
1652         wl->beacon1_uploaded = 0;
1653         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1654 }
1655
1656 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1657 {
1658         b43_time_lock(dev);
1659         if (dev->dev->id.revision >= 3) {
1660                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1661                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1662         } else {
1663                 b43_write16(dev, 0x606, (beacon_int >> 6));
1664                 b43_write16(dev, 0x610, beacon_int);
1665         }
1666         b43_time_unlock(dev);
1667         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1668 }
1669
1670 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1671 {
1672         u16 reason;
1673
1674         /* Read the register that contains the reason code for the panic. */
1675         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1676         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1677
1678         switch (reason) {
1679         default:
1680                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1681                 /* fallthrough */
1682         case B43_FWPANIC_DIE:
1683                 /* Do not restart the controller or firmware.
1684                  * The device is nonfunctional from now on.
1685                  * Restarting would result in this panic to trigger again,
1686                  * so we avoid that recursion. */
1687                 break;
1688         case B43_FWPANIC_RESTART:
1689                 b43_controller_restart(dev, "Microcode panic");
1690                 break;
1691         }
1692 }
1693
1694 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1695 {
1696         unsigned int i, cnt;
1697         u16 reason, marker_id, marker_line;
1698         __le16 *buf;
1699
1700         /* The proprietary firmware doesn't have this IRQ. */
1701         if (!dev->fw.opensource)
1702                 return;
1703
1704         /* Read the register that contains the reason code for this IRQ. */
1705         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1706
1707         switch (reason) {
1708         case B43_DEBUGIRQ_PANIC:
1709                 b43_handle_firmware_panic(dev);
1710                 break;
1711         case B43_DEBUGIRQ_DUMP_SHM:
1712                 if (!B43_DEBUG)
1713                         break; /* Only with driver debugging enabled. */
1714                 buf = kmalloc(4096, GFP_ATOMIC);
1715                 if (!buf) {
1716                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1717                         goto out;
1718                 }
1719                 for (i = 0; i < 4096; i += 2) {
1720                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1721                         buf[i / 2] = cpu_to_le16(tmp);
1722                 }
1723                 b43info(dev->wl, "Shared memory dump:\n");
1724                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1725                                16, 2, buf, 4096, 1);
1726                 kfree(buf);
1727                 break;
1728         case B43_DEBUGIRQ_DUMP_REGS:
1729                 if (!B43_DEBUG)
1730                         break; /* Only with driver debugging enabled. */
1731                 b43info(dev->wl, "Microcode register dump:\n");
1732                 for (i = 0, cnt = 0; i < 64; i++) {
1733                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1734                         if (cnt == 0)
1735                                 printk(KERN_INFO);
1736                         printk("r%02u: 0x%04X  ", i, tmp);
1737                         cnt++;
1738                         if (cnt == 6) {
1739                                 printk("\n");
1740                                 cnt = 0;
1741                         }
1742                 }
1743                 printk("\n");
1744                 break;
1745         case B43_DEBUGIRQ_MARKER:
1746                 if (!B43_DEBUG)
1747                         break; /* Only with driver debugging enabled. */
1748                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1749                                            B43_MARKER_ID_REG);
1750                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1751                                              B43_MARKER_LINE_REG);
1752                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1753                         "at line number %u\n",
1754                         marker_id, marker_line);
1755                 break;
1756         default:
1757                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1758                        reason);
1759         }
1760 out:
1761         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1762         b43_shm_write16(dev, B43_SHM_SCRATCH,
1763                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1764 }
1765
1766 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1767 {
1768         u32 reason;
1769         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1770         u32 merged_dma_reason = 0;
1771         int i;
1772
1773         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1774                 return;
1775
1776         reason = dev->irq_reason;
1777         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1778                 dma_reason[i] = dev->dma_reason[i];
1779                 merged_dma_reason |= dma_reason[i];
1780         }
1781
1782         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1783                 b43err(dev->wl, "MAC transmission error\n");
1784
1785         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1786                 b43err(dev->wl, "PHY transmission error\n");
1787                 rmb();
1788                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1789                         atomic_set(&dev->phy.txerr_cnt,
1790                                    B43_PHY_TX_BADNESS_LIMIT);
1791                         b43err(dev->wl, "Too many PHY TX errors, "
1792                                         "restarting the controller\n");
1793                         b43_controller_restart(dev, "PHY TX errors");
1794                 }
1795         }
1796
1797         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1798                                           B43_DMAIRQ_NONFATALMASK))) {
1799                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1800                         b43err(dev->wl, "Fatal DMA error: "
1801                                "0x%08X, 0x%08X, 0x%08X, "
1802                                "0x%08X, 0x%08X, 0x%08X\n",
1803                                dma_reason[0], dma_reason[1],
1804                                dma_reason[2], dma_reason[3],
1805                                dma_reason[4], dma_reason[5]);
1806                         b43err(dev->wl, "This device does not support DMA "
1807                                "on your system. Please use PIO instead.\n");
1808                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1809                         dev->use_pio = 1;
1810                         b43_controller_restart(dev, "DMA error");
1811                         return;
1812                 }
1813                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1814                         b43err(dev->wl, "DMA error: "
1815                                "0x%08X, 0x%08X, 0x%08X, "
1816                                "0x%08X, 0x%08X, 0x%08X\n",
1817                                dma_reason[0], dma_reason[1],
1818                                dma_reason[2], dma_reason[3],
1819                                dma_reason[4], dma_reason[5]);
1820                 }
1821         }
1822
1823         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1824                 handle_irq_ucode_debug(dev);
1825         if (reason & B43_IRQ_TBTT_INDI)
1826                 handle_irq_tbtt_indication(dev);
1827         if (reason & B43_IRQ_ATIM_END)
1828                 handle_irq_atim_end(dev);
1829         if (reason & B43_IRQ_BEACON)
1830                 handle_irq_beacon(dev);
1831         if (reason & B43_IRQ_PMQ)
1832                 handle_irq_pmq(dev);
1833         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1834                 ;/* TODO */
1835         if (reason & B43_IRQ_NOISESAMPLE_OK)
1836                 handle_irq_noise(dev);
1837
1838         /* Check the DMA reason registers for received data. */
1839         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1840                 if (b43_using_pio_transfers(dev))
1841                         b43_pio_rx(dev->pio.rx_queue);
1842                 else
1843                         b43_dma_rx(dev->dma.rx_ring);
1844         }
1845         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1846         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1847         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1848         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1849         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1850
1851         if (reason & B43_IRQ_TX_OK)
1852                 handle_irq_transmit_status(dev);
1853
1854         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1855         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1856
1857 #if B43_DEBUG
1858         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1859                 dev->irq_count++;
1860                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1861                         if (reason & (1 << i))
1862                                 dev->irq_bit_count[i]++;
1863                 }
1864         }
1865 #endif
1866 }
1867
1868 /* Interrupt thread handler. Handles device interrupts in thread context. */
1869 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1870 {
1871         struct b43_wldev *dev = dev_id;
1872
1873         mutex_lock(&dev->wl->mutex);
1874         b43_do_interrupt_thread(dev);
1875         mmiowb();
1876         mutex_unlock(&dev->wl->mutex);
1877
1878         return IRQ_HANDLED;
1879 }
1880
1881 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1882 {
1883         u32 reason;
1884
1885         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1886          * On SDIO, this runs under wl->mutex. */
1887
1888         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1889         if (reason == 0xffffffff)       /* shared IRQ */
1890                 return IRQ_NONE;
1891         reason &= dev->irq_mask;
1892         if (!reason)
1893                 return IRQ_HANDLED;
1894
1895         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1896             & 0x0001DC00;
1897         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1898             & 0x0000DC00;
1899         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1900             & 0x0000DC00;
1901         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1902             & 0x0001DC00;
1903         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1904             & 0x0000DC00;
1905 /* Unused ring
1906         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1907             & 0x0000DC00;
1908 */
1909
1910         /* ACK the interrupt. */
1911         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1912         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1913         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1914         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1915         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1916         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1917 /* Unused ring
1918         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1919 */
1920
1921         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1922         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1923         /* Save the reason bitmasks for the IRQ thread handler. */
1924         dev->irq_reason = reason;
1925
1926         return IRQ_WAKE_THREAD;
1927 }
1928
1929 /* Interrupt handler top-half. This runs with interrupts disabled. */
1930 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1931 {
1932         struct b43_wldev *dev = dev_id;
1933         irqreturn_t ret;
1934
1935         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1936                 return IRQ_NONE;
1937
1938         spin_lock(&dev->wl->hardirq_lock);
1939         ret = b43_do_interrupt(dev);
1940         mmiowb();
1941         spin_unlock(&dev->wl->hardirq_lock);
1942
1943         return ret;
1944 }
1945
1946 /* SDIO interrupt handler. This runs in process context. */
1947 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1948 {
1949         struct b43_wl *wl = dev->wl;
1950         irqreturn_t ret;
1951
1952         mutex_lock(&wl->mutex);
1953
1954         ret = b43_do_interrupt(dev);
1955         if (ret == IRQ_WAKE_THREAD)
1956                 b43_do_interrupt_thread(dev);
1957
1958         mutex_unlock(&wl->mutex);
1959 }
1960
1961 void b43_do_release_fw(struct b43_firmware_file *fw)
1962 {
1963         release_firmware(fw->data);
1964         fw->data = NULL;
1965         fw->filename = NULL;
1966 }
1967
1968 static void b43_release_firmware(struct b43_wldev *dev)
1969 {
1970         b43_do_release_fw(&dev->fw.ucode);
1971         b43_do_release_fw(&dev->fw.pcm);
1972         b43_do_release_fw(&dev->fw.initvals);
1973         b43_do_release_fw(&dev->fw.initvals_band);
1974 }
1975
1976 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1977 {
1978         const char text[] =
1979                 "You must go to " \
1980                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1981                 "and download the correct firmware for this driver version. " \
1982                 "Please carefully read all instructions on this website.\n";
1983
1984         if (error)
1985                 b43err(wl, text);
1986         else
1987                 b43warn(wl, text);
1988 }
1989
1990 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1991                       const char *name,
1992                       struct b43_firmware_file *fw)
1993 {
1994         const struct firmware *blob;
1995         struct b43_fw_header *hdr;
1996         u32 size;
1997         int err;
1998
1999         if (!name) {
2000                 /* Don't fetch anything. Free possibly cached firmware. */
2001                 /* FIXME: We should probably keep it anyway, to save some headache
2002                  * on suspend/resume with multiband devices. */
2003                 b43_do_release_fw(fw);
2004                 return 0;
2005         }
2006         if (fw->filename) {
2007                 if ((fw->type == ctx->req_type) &&
2008                     (strcmp(fw->filename, name) == 0))
2009                         return 0; /* Already have this fw. */
2010                 /* Free the cached firmware first. */
2011                 /* FIXME: We should probably do this later after we successfully
2012                  * got the new fw. This could reduce headache with multiband devices.
2013                  * We could also redesign this to cache the firmware for all possible
2014                  * bands all the time. */
2015                 b43_do_release_fw(fw);
2016         }
2017
2018         switch (ctx->req_type) {
2019         case B43_FWTYPE_PROPRIETARY:
2020                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2021                          "b43%s/%s.fw",
2022                          modparam_fwpostfix, name);
2023                 break;
2024         case B43_FWTYPE_OPENSOURCE:
2025                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2026                          "b43-open%s/%s.fw",
2027                          modparam_fwpostfix, name);
2028                 break;
2029         default:
2030                 B43_WARN_ON(1);
2031                 return -ENOSYS;
2032         }
2033         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2034         if (err == -ENOENT) {
2035                 snprintf(ctx->errors[ctx->req_type],
2036                          sizeof(ctx->errors[ctx->req_type]),
2037                          "Firmware file \"%s\" not found\n", ctx->fwname);
2038                 return err;
2039         } else if (err) {
2040                 snprintf(ctx->errors[ctx->req_type],
2041                          sizeof(ctx->errors[ctx->req_type]),
2042                          "Firmware file \"%s\" request failed (err=%d)\n",
2043                          ctx->fwname, err);
2044                 return err;
2045         }
2046         if (blob->size < sizeof(struct b43_fw_header))
2047                 goto err_format;
2048         hdr = (struct b43_fw_header *)(blob->data);
2049         switch (hdr->type) {
2050         case B43_FW_TYPE_UCODE:
2051         case B43_FW_TYPE_PCM:
2052                 size = be32_to_cpu(hdr->size);
2053                 if (size != blob->size - sizeof(struct b43_fw_header))
2054                         goto err_format;
2055                 /* fallthrough */
2056         case B43_FW_TYPE_IV:
2057                 if (hdr->ver != 1)
2058                         goto err_format;
2059                 break;
2060         default:
2061                 goto err_format;
2062         }
2063
2064         fw->data = blob;
2065         fw->filename = name;
2066         fw->type = ctx->req_type;
2067
2068         return 0;
2069
2070 err_format:
2071         snprintf(ctx->errors[ctx->req_type],
2072                  sizeof(ctx->errors[ctx->req_type]),
2073                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2074         release_firmware(blob);
2075
2076         return -EPROTO;
2077 }
2078
2079 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2080 {
2081         struct b43_wldev *dev = ctx->dev;
2082         struct b43_firmware *fw = &ctx->dev->fw;
2083         const u8 rev = ctx->dev->dev->id.revision;
2084         const char *filename;
2085         u32 tmshigh;
2086         int err;
2087
2088         /* Get microcode */
2089         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2090         if ((rev >= 5) && (rev <= 10))
2091                 filename = "ucode5";
2092         else if ((rev >= 11) && (rev <= 12))
2093                 filename = "ucode11";
2094         else if (rev == 13)
2095                 filename = "ucode13";
2096         else if (rev == 14)
2097                 filename = "ucode14";
2098         else if (rev >= 15)
2099                 filename = "ucode15";
2100         else
2101                 goto err_no_ucode;
2102         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2103         if (err)
2104                 goto err_load;
2105
2106         /* Get PCM code */
2107         if ((rev >= 5) && (rev <= 10))
2108                 filename = "pcm5";
2109         else if (rev >= 11)
2110                 filename = NULL;
2111         else
2112                 goto err_no_pcm;
2113         fw->pcm_request_failed = 0;
2114         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2115         if (err == -ENOENT) {
2116                 /* We did not find a PCM file? Not fatal, but
2117                  * core rev <= 10 must do without hwcrypto then. */
2118                 fw->pcm_request_failed = 1;
2119         } else if (err)
2120                 goto err_load;
2121
2122         /* Get initvals */
2123         switch (dev->phy.type) {
2124         case B43_PHYTYPE_A:
2125                 if ((rev >= 5) && (rev <= 10)) {
2126                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2127                                 filename = "a0g1initvals5";
2128                         else
2129                                 filename = "a0g0initvals5";
2130                 } else
2131                         goto err_no_initvals;
2132                 break;
2133         case B43_PHYTYPE_G:
2134                 if ((rev >= 5) && (rev <= 10))
2135                         filename = "b0g0initvals5";
2136                 else if (rev >= 13)
2137                         filename = "b0g0initvals13";
2138                 else
2139                         goto err_no_initvals;
2140                 break;
2141         case B43_PHYTYPE_N:
2142                 if ((rev >= 11) && (rev <= 12))
2143                         filename = "n0initvals11";
2144                 else
2145                         goto err_no_initvals;
2146                 break;
2147         case B43_PHYTYPE_LP:
2148                 if (rev == 13)
2149                         filename = "lp0initvals13";
2150                 else if (rev == 14)
2151                         filename = "lp0initvals14";
2152                 else if (rev >= 15)
2153                         filename = "lp0initvals15";
2154                 else
2155                         goto err_no_initvals;
2156                 break;
2157         default:
2158                 goto err_no_initvals;
2159         }
2160         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2161         if (err)
2162                 goto err_load;
2163
2164         /* Get bandswitch initvals */
2165         switch (dev->phy.type) {
2166         case B43_PHYTYPE_A:
2167                 if ((rev >= 5) && (rev <= 10)) {
2168                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2169                                 filename = "a0g1bsinitvals5";
2170                         else
2171                                 filename = "a0g0bsinitvals5";
2172                 } else if (rev >= 11)
2173                         filename = NULL;
2174                 else
2175                         goto err_no_initvals;
2176                 break;
2177         case B43_PHYTYPE_G:
2178                 if ((rev >= 5) && (rev <= 10))
2179                         filename = "b0g0bsinitvals5";
2180                 else if (rev >= 11)
2181                         filename = NULL;
2182                 else
2183                         goto err_no_initvals;
2184                 break;
2185         case B43_PHYTYPE_N:
2186                 if ((rev >= 11) && (rev <= 12))
2187                         filename = "n0bsinitvals11";
2188                 else
2189                         goto err_no_initvals;
2190                 break;
2191         case B43_PHYTYPE_LP:
2192                 if (rev == 13)
2193                         filename = "lp0bsinitvals13";
2194                 else if (rev == 14)
2195                         filename = "lp0bsinitvals14";
2196                 else if (rev >= 15)
2197                         filename = "lp0bsinitvals15";
2198                 else
2199                         goto err_no_initvals;
2200                 break;
2201         default:
2202                 goto err_no_initvals;
2203         }
2204         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2205         if (err)
2206                 goto err_load;
2207
2208         return 0;
2209
2210 err_no_ucode:
2211         err = ctx->fatal_failure = -EOPNOTSUPP;
2212         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2213                "is required for your device (wl-core rev %u)\n", rev);
2214         goto error;
2215
2216 err_no_pcm:
2217         err = ctx->fatal_failure = -EOPNOTSUPP;
2218         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2219                "is required for your device (wl-core rev %u)\n", rev);
2220         goto error;
2221
2222 err_no_initvals:
2223         err = ctx->fatal_failure = -EOPNOTSUPP;
2224         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2225                "is required for your device (wl-core rev %u)\n", rev);
2226         goto error;
2227
2228 err_load:
2229         /* We failed to load this firmware image. The error message
2230          * already is in ctx->errors. Return and let our caller decide
2231          * what to do. */
2232         goto error;
2233
2234 error:
2235         b43_release_firmware(dev);
2236         return err;
2237 }
2238
2239 static int b43_request_firmware(struct b43_wldev *dev)
2240 {
2241         struct b43_request_fw_context *ctx;
2242         unsigned int i;
2243         int err;
2244         const char *errmsg;
2245
2246         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2247         if (!ctx)
2248                 return -ENOMEM;
2249         ctx->dev = dev;
2250
2251         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2252         err = b43_try_request_fw(ctx);
2253         if (!err)
2254                 goto out; /* Successfully loaded it. */
2255         err = ctx->fatal_failure;
2256         if (err)
2257                 goto out;
2258
2259         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2260         err = b43_try_request_fw(ctx);
2261         if (!err)
2262                 goto out; /* Successfully loaded it. */
2263         err = ctx->fatal_failure;
2264         if (err)
2265                 goto out;
2266
2267         /* Could not find a usable firmware. Print the errors. */
2268         for (i = 0; i < B43_NR_FWTYPES; i++) {
2269                 errmsg = ctx->errors[i];
2270                 if (strlen(errmsg))
2271                         b43err(dev->wl, errmsg);
2272         }
2273         b43_print_fw_helptext(dev->wl, 1);
2274         err = -ENOENT;
2275
2276 out:
2277         kfree(ctx);
2278         return err;
2279 }
2280
2281 static int b43_upload_microcode(struct b43_wldev *dev)
2282 {
2283         const size_t hdr_len = sizeof(struct b43_fw_header);
2284         const __be32 *data;
2285         unsigned int i, len;
2286         u16 fwrev, fwpatch, fwdate, fwtime;
2287         u32 tmp, macctl;
2288         int err = 0;
2289
2290         /* Jump the microcode PSM to offset 0 */
2291         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2292         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2293         macctl |= B43_MACCTL_PSM_JMP0;
2294         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2295         /* Zero out all microcode PSM registers and shared memory. */
2296         for (i = 0; i < 64; i++)
2297                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2298         for (i = 0; i < 4096; i += 2)
2299                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2300
2301         /* Upload Microcode. */
2302         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2303         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2304         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2305         for (i = 0; i < len; i++) {
2306                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2307                 udelay(10);
2308         }
2309
2310         if (dev->fw.pcm.data) {
2311                 /* Upload PCM data. */
2312                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2313                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2314                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2315                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2316                 /* No need for autoinc bit in SHM_HW */
2317                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2318                 for (i = 0; i < len; i++) {
2319                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2320                         udelay(10);
2321                 }
2322         }
2323
2324         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2325
2326         /* Start the microcode PSM */
2327         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2328         macctl &= ~B43_MACCTL_PSM_JMP0;
2329         macctl |= B43_MACCTL_PSM_RUN;
2330         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2331
2332         /* Wait for the microcode to load and respond */
2333         i = 0;
2334         while (1) {
2335                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2336                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2337                         break;
2338                 i++;
2339                 if (i >= 20) {
2340                         b43err(dev->wl, "Microcode not responding\n");
2341                         b43_print_fw_helptext(dev->wl, 1);
2342                         err = -ENODEV;
2343                         goto error;
2344                 }
2345                 msleep(50);
2346         }
2347         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2348
2349         /* Get and check the revisions. */
2350         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2351         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2352         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2353         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2354
2355         if (fwrev <= 0x128) {
2356                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2357                        "binary drivers older than version 4.x is unsupported. "
2358                        "You must upgrade your firmware files.\n");
2359                 b43_print_fw_helptext(dev->wl, 1);
2360                 err = -EOPNOTSUPP;
2361                 goto error;
2362         }
2363         dev->fw.rev = fwrev;
2364         dev->fw.patch = fwpatch;
2365         dev->fw.opensource = (fwdate == 0xFFFF);
2366
2367         /* Default to use-all-queues. */
2368         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2369         dev->qos_enabled = !!modparam_qos;
2370         /* Default to firmware/hardware crypto acceleration. */
2371         dev->hwcrypto_enabled = 1;
2372
2373         if (dev->fw.opensource) {
2374                 u16 fwcapa;
2375
2376                 /* Patchlevel info is encoded in the "time" field. */
2377                 dev->fw.patch = fwtime;
2378                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2379                         dev->fw.rev, dev->fw.patch);
2380
2381                 fwcapa = b43_fwcapa_read(dev);
2382                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2383                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2384                         /* Disable hardware crypto and fall back to software crypto. */
2385                         dev->hwcrypto_enabled = 0;
2386                 }
2387                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2388                         b43info(dev->wl, "QoS not supported by firmware\n");
2389                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2390                          * ieee80211_unregister to make sure the networking core can
2391                          * properly free possible resources. */
2392                         dev->wl->hw->queues = 1;
2393                         dev->qos_enabled = 0;
2394                 }
2395         } else {
2396                 b43info(dev->wl, "Loading firmware version %u.%u "
2397                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2398                         fwrev, fwpatch,
2399                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2400                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2401                 if (dev->fw.pcm_request_failed) {
2402                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2403                                 "Hardware accelerated cryptography is disabled.\n");
2404                         b43_print_fw_helptext(dev->wl, 0);
2405                 }
2406         }
2407
2408         if (b43_is_old_txhdr_format(dev)) {
2409                 /* We're over the deadline, but we keep support for old fw
2410                  * until it turns out to be in major conflict with something new. */
2411                 b43warn(dev->wl, "You are using an old firmware image. "
2412                         "Support for old firmware will be removed soon "
2413                         "(official deadline was July 2008).\n");
2414                 b43_print_fw_helptext(dev->wl, 0);
2415         }
2416
2417         return 0;
2418
2419 error:
2420         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2421         macctl &= ~B43_MACCTL_PSM_RUN;
2422         macctl |= B43_MACCTL_PSM_JMP0;
2423         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2424
2425         return err;
2426 }
2427
2428 static int b43_write_initvals(struct b43_wldev *dev,
2429                               const struct b43_iv *ivals,
2430                               size_t count,
2431                               size_t array_size)
2432 {
2433         const struct b43_iv *iv;
2434         u16 offset;
2435         size_t i;
2436         bool bit32;
2437
2438         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2439         iv = ivals;
2440         for (i = 0; i < count; i++) {
2441                 if (array_size < sizeof(iv->offset_size))
2442                         goto err_format;
2443                 array_size -= sizeof(iv->offset_size);
2444                 offset = be16_to_cpu(iv->offset_size);
2445                 bit32 = !!(offset & B43_IV_32BIT);
2446                 offset &= B43_IV_OFFSET_MASK;
2447                 if (offset >= 0x1000)
2448                         goto err_format;
2449                 if (bit32) {
2450                         u32 value;
2451
2452                         if (array_size < sizeof(iv->data.d32))
2453                                 goto err_format;
2454                         array_size -= sizeof(iv->data.d32);
2455
2456                         value = get_unaligned_be32(&iv->data.d32);
2457                         b43_write32(dev, offset, value);
2458
2459                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2460                                                         sizeof(__be16) +
2461                                                         sizeof(__be32));
2462                 } else {
2463                         u16 value;
2464
2465                         if (array_size < sizeof(iv->data.d16))
2466                                 goto err_format;
2467                         array_size -= sizeof(iv->data.d16);
2468
2469                         value = be16_to_cpu(iv->data.d16);
2470                         b43_write16(dev, offset, value);
2471
2472                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2473                                                         sizeof(__be16) +
2474                                                         sizeof(__be16));
2475                 }
2476         }
2477         if (array_size)
2478                 goto err_format;
2479
2480         return 0;
2481
2482 err_format:
2483         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2484         b43_print_fw_helptext(dev->wl, 1);
2485
2486         return -EPROTO;
2487 }
2488
2489 static int b43_upload_initvals(struct b43_wldev *dev)
2490 {
2491         const size_t hdr_len = sizeof(struct b43_fw_header);
2492         const struct b43_fw_header *hdr;
2493         struct b43_firmware *fw = &dev->fw;
2494         const struct b43_iv *ivals;
2495         size_t count;
2496         int err;
2497
2498         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2499         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2500         count = be32_to_cpu(hdr->size);
2501         err = b43_write_initvals(dev, ivals, count,
2502                                  fw->initvals.data->size - hdr_len);
2503         if (err)
2504                 goto out;
2505         if (fw->initvals_band.data) {
2506                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2507                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2508                 count = be32_to_cpu(hdr->size);
2509                 err = b43_write_initvals(dev, ivals, count,
2510                                          fw->initvals_band.data->size - hdr_len);
2511                 if (err)
2512                         goto out;
2513         }
2514 out:
2515
2516         return err;
2517 }
2518
2519 /* Initialize the GPIOs
2520  * http://bcm-specs.sipsolutions.net/GPIO
2521  */
2522 static int b43_gpio_init(struct b43_wldev *dev)
2523 {
2524         struct ssb_bus *bus = dev->dev->bus;
2525         struct ssb_device *gpiodev, *pcidev = NULL;
2526         u32 mask, set;
2527
2528         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2529                     & ~B43_MACCTL_GPOUTSMSK);
2530
2531         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2532                     | 0x000F);
2533
2534         mask = 0x0000001F;
2535         set = 0x0000000F;
2536         if (dev->dev->bus->chip_id == 0x4301) {
2537                 mask |= 0x0060;
2538                 set |= 0x0060;
2539         }
2540         if (0 /* FIXME: conditional unknown */ ) {
2541                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2542                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2543                             | 0x0100);
2544                 mask |= 0x0180;
2545                 set |= 0x0180;
2546         }
2547         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2548                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2549                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2550                             | 0x0200);
2551                 mask |= 0x0200;
2552                 set |= 0x0200;
2553         }
2554         if (dev->dev->id.revision >= 2)
2555                 mask |= 0x0010; /* FIXME: This is redundant. */
2556
2557 #ifdef CONFIG_SSB_DRIVER_PCICORE
2558         pcidev = bus->pcicore.dev;
2559 #endif
2560         gpiodev = bus->chipco.dev ? : pcidev;
2561         if (!gpiodev)
2562                 return 0;
2563         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2564                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2565                      & mask) | set);
2566
2567         return 0;
2568 }
2569
2570 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2571 static void b43_gpio_cleanup(struct b43_wldev *dev)
2572 {
2573         struct ssb_bus *bus = dev->dev->bus;
2574         struct ssb_device *gpiodev, *pcidev = NULL;
2575
2576 #ifdef CONFIG_SSB_DRIVER_PCICORE
2577         pcidev = bus->pcicore.dev;
2578 #endif
2579         gpiodev = bus->chipco.dev ? : pcidev;
2580         if (!gpiodev)
2581                 return;
2582         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2583 }
2584
2585 /* http://bcm-specs.sipsolutions.net/EnableMac */
2586 void b43_mac_enable(struct b43_wldev *dev)
2587 {
2588         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2589                 u16 fwstate;
2590
2591                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2592                                          B43_SHM_SH_UCODESTAT);
2593                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2594                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2595                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2596                                "should be suspended, but current state is %u\n",
2597                                fwstate);
2598                 }
2599         }
2600
2601         dev->mac_suspended--;
2602         B43_WARN_ON(dev->mac_suspended < 0);
2603         if (dev->mac_suspended == 0) {
2604                 b43_write32(dev, B43_MMIO_MACCTL,
2605                             b43_read32(dev, B43_MMIO_MACCTL)
2606                             | B43_MACCTL_ENABLED);
2607                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2608                             B43_IRQ_MAC_SUSPENDED);
2609                 /* Commit writes */
2610                 b43_read32(dev, B43_MMIO_MACCTL);
2611                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2612                 b43_power_saving_ctl_bits(dev, 0);
2613         }
2614 }
2615
2616 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2617 void b43_mac_suspend(struct b43_wldev *dev)
2618 {
2619         int i;
2620         u32 tmp;
2621
2622         might_sleep();
2623         B43_WARN_ON(dev->mac_suspended < 0);
2624
2625         if (dev->mac_suspended == 0) {
2626                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2627                 b43_write32(dev, B43_MMIO_MACCTL,
2628                             b43_read32(dev, B43_MMIO_MACCTL)
2629                             & ~B43_MACCTL_ENABLED);
2630                 /* force pci to flush the write */
2631                 b43_read32(dev, B43_MMIO_MACCTL);
2632                 for (i = 35; i; i--) {
2633                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2634                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2635                                 goto out;
2636                         udelay(10);
2637                 }
2638                 /* Hm, it seems this will take some time. Use msleep(). */
2639                 for (i = 40; i; i--) {
2640                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2641                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2642                                 goto out;
2643                         msleep(1);
2644                 }
2645                 b43err(dev->wl, "MAC suspend failed\n");
2646         }
2647 out:
2648         dev->mac_suspended++;
2649 }
2650
2651 static void b43_adjust_opmode(struct b43_wldev *dev)
2652 {
2653         struct b43_wl *wl = dev->wl;
2654         u32 ctl;
2655         u16 cfp_pretbtt;
2656
2657         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2658         /* Reset status to STA infrastructure mode. */
2659         ctl &= ~B43_MACCTL_AP;
2660         ctl &= ~B43_MACCTL_KEEP_CTL;
2661         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2662         ctl &= ~B43_MACCTL_KEEP_BAD;
2663         ctl &= ~B43_MACCTL_PROMISC;
2664         ctl &= ~B43_MACCTL_BEACPROMISC;
2665         ctl |= B43_MACCTL_INFRA;
2666
2667         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2668             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2669                 ctl |= B43_MACCTL_AP;
2670         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2671                 ctl &= ~B43_MACCTL_INFRA;
2672
2673         if (wl->filter_flags & FIF_CONTROL)
2674                 ctl |= B43_MACCTL_KEEP_CTL;
2675         if (wl->filter_flags & FIF_FCSFAIL)
2676                 ctl |= B43_MACCTL_KEEP_BAD;
2677         if (wl->filter_flags & FIF_PLCPFAIL)
2678                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2679         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2680                 ctl |= B43_MACCTL_PROMISC;
2681         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2682                 ctl |= B43_MACCTL_BEACPROMISC;
2683
2684         /* Workaround: On old hardware the HW-MAC-address-filter
2685          * doesn't work properly, so always run promisc in filter
2686          * it in software. */
2687         if (dev->dev->id.revision <= 4)
2688                 ctl |= B43_MACCTL_PROMISC;
2689
2690         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2691
2692         cfp_pretbtt = 2;
2693         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2694                 if (dev->dev->bus->chip_id == 0x4306 &&
2695                     dev->dev->bus->chip_rev == 3)
2696                         cfp_pretbtt = 100;
2697                 else
2698                         cfp_pretbtt = 50;
2699         }
2700         b43_write16(dev, 0x612, cfp_pretbtt);
2701
2702         /* FIXME: We don't currently implement the PMQ mechanism,
2703          *        so always disable it. If we want to implement PMQ,
2704          *        we need to enable it here (clear DISCPMQ) in AP mode.
2705          */
2706         if (0  /* ctl & B43_MACCTL_AP */) {
2707                 b43_write32(dev, B43_MMIO_MACCTL,
2708                             b43_read32(dev, B43_MMIO_MACCTL)
2709                             & ~B43_MACCTL_DISCPMQ);
2710         } else {
2711                 b43_write32(dev, B43_MMIO_MACCTL,
2712                             b43_read32(dev, B43_MMIO_MACCTL)
2713                             | B43_MACCTL_DISCPMQ);
2714         }
2715 }
2716
2717 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2718 {
2719         u16 offset;
2720
2721         if (is_ofdm) {
2722                 offset = 0x480;
2723                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2724         } else {
2725                 offset = 0x4C0;
2726                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2727         }
2728         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2729                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2730 }
2731
2732 static void b43_rate_memory_init(struct b43_wldev *dev)
2733 {
2734         switch (dev->phy.type) {
2735         case B43_PHYTYPE_A:
2736         case B43_PHYTYPE_G:
2737         case B43_PHYTYPE_N:
2738         case B43_PHYTYPE_LP:
2739                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2740                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2741                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2742                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2743                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2744                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2745                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2746                 if (dev->phy.type == B43_PHYTYPE_A)
2747                         break;
2748                 /* fallthrough */
2749         case B43_PHYTYPE_B:
2750                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2751                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2752                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2753                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2754                 break;
2755         default:
2756                 B43_WARN_ON(1);
2757         }
2758 }
2759
2760 /* Set the default values for the PHY TX Control Words. */
2761 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2762 {
2763         u16 ctl = 0;
2764
2765         ctl |= B43_TXH_PHY_ENC_CCK;
2766         ctl |= B43_TXH_PHY_ANT01AUTO;
2767         ctl |= B43_TXH_PHY_TXPWR;
2768
2769         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2770         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2771         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2772 }
2773
2774 /* Set the TX-Antenna for management frames sent by firmware. */
2775 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2776 {
2777         u16 ant;
2778         u16 tmp;
2779
2780         ant = b43_antenna_to_phyctl(antenna);
2781
2782         /* For ACK/CTS */
2783         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2784         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2785         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2786         /* For Probe Resposes */
2787         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2788         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2789         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2790 }
2791
2792 /* This is the opposite of b43_chip_init() */
2793 static void b43_chip_exit(struct b43_wldev *dev)
2794 {
2795         b43_phy_exit(dev);
2796         b43_gpio_cleanup(dev);
2797         /* firmware is released later */
2798 }
2799
2800 /* Initialize the chip
2801  * http://bcm-specs.sipsolutions.net/ChipInit
2802  */
2803 static int b43_chip_init(struct b43_wldev *dev)
2804 {
2805         struct b43_phy *phy = &dev->phy;
2806         int err;
2807         u32 value32, macctl;
2808         u16 value16;
2809
2810         /* Initialize the MAC control */
2811         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2812         if (dev->phy.gmode)
2813                 macctl |= B43_MACCTL_GMODE;
2814         macctl |= B43_MACCTL_INFRA;
2815         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2816
2817         err = b43_request_firmware(dev);
2818         if (err)
2819                 goto out;
2820         err = b43_upload_microcode(dev);
2821         if (err)
2822                 goto out;       /* firmware is released later */
2823
2824         err = b43_gpio_init(dev);
2825         if (err)
2826                 goto out;       /* firmware is released later */
2827
2828         err = b43_upload_initvals(dev);
2829         if (err)
2830                 goto err_gpio_clean;
2831
2832         /* Turn the Analog on and initialize the PHY. */
2833         phy->ops->switch_analog(dev, 1);
2834         err = b43_phy_init(dev);
2835         if (err)
2836                 goto err_gpio_clean;
2837
2838         /* Disable Interference Mitigation. */
2839         if (phy->ops->interf_mitigation)
2840                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2841
2842         /* Select the antennae */
2843         if (phy->ops->set_rx_antenna)
2844                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2845         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2846
2847         if (phy->type == B43_PHYTYPE_B) {
2848                 value16 = b43_read16(dev, 0x005E);
2849                 value16 |= 0x0004;
2850                 b43_write16(dev, 0x005E, value16);
2851         }
2852         b43_write32(dev, 0x0100, 0x01000000);
2853         if (dev->dev->id.revision < 5)
2854                 b43_write32(dev, 0x010C, 0x01000000);
2855
2856         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2857                     & ~B43_MACCTL_INFRA);
2858         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2859                     | B43_MACCTL_INFRA);
2860
2861         /* Probe Response Timeout value */
2862         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2863         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2864
2865         /* Initially set the wireless operation mode. */
2866         b43_adjust_opmode(dev);
2867
2868         if (dev->dev->id.revision < 3) {
2869                 b43_write16(dev, 0x060E, 0x0000);
2870                 b43_write16(dev, 0x0610, 0x8000);
2871                 b43_write16(dev, 0x0604, 0x0000);
2872                 b43_write16(dev, 0x0606, 0x0200);
2873         } else {
2874                 b43_write32(dev, 0x0188, 0x80000000);
2875                 b43_write32(dev, 0x018C, 0x02000000);
2876         }
2877         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2878         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2879         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2880         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2881         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2882         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2883         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2884
2885         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2886         value32 |= 0x00100000;
2887         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2888
2889         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2890                     dev->dev->bus->chipco.fast_pwrup_delay);
2891
2892         err = 0;
2893         b43dbg(dev->wl, "Chip initialized\n");
2894 out:
2895         return err;
2896
2897 err_gpio_clean:
2898         b43_gpio_cleanup(dev);
2899         return err;
2900 }
2901
2902 static void b43_periodic_every60sec(struct b43_wldev *dev)
2903 {
2904         const struct b43_phy_operations *ops = dev->phy.ops;
2905
2906         if (ops->pwork_60sec)
2907                 ops->pwork_60sec(dev);
2908
2909         /* Force check the TX power emission now. */
2910         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2911 }
2912
2913 static void b43_periodic_every30sec(struct b43_wldev *dev)
2914 {
2915         /* Update device statistics. */
2916         b43_calculate_link_quality(dev);
2917 }
2918
2919 static void b43_periodic_every15sec(struct b43_wldev *dev)
2920 {
2921         struct b43_phy *phy = &dev->phy;
2922         u16 wdr;
2923
2924         if (dev->fw.opensource) {
2925                 /* Check if the firmware is still alive.
2926                  * It will reset the watchdog counter to 0 in its idle loop. */
2927                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2928                 if (unlikely(wdr)) {
2929                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2930                         b43_controller_restart(dev, "Firmware watchdog");
2931                         return;
2932                 } else {
2933                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2934                                         B43_WATCHDOG_REG, 1);
2935                 }
2936         }
2937
2938         if (phy->ops->pwork_15sec)
2939                 phy->ops->pwork_15sec(dev);
2940
2941         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2942         wmb();
2943
2944 #if B43_DEBUG
2945         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2946                 unsigned int i;
2947
2948                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
2949                        dev->irq_count / 15,
2950                        dev->tx_count / 15,
2951                        dev->rx_count / 15);
2952                 dev->irq_count = 0;
2953                 dev->tx_count = 0;
2954                 dev->rx_count = 0;
2955                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2956                         if (dev->irq_bit_count[i]) {
2957                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
2958                                        dev->irq_bit_count[i] / 15, i, (1 << i));
2959                                 dev->irq_bit_count[i] = 0;
2960                         }
2961                 }
2962         }
2963 #endif
2964 }
2965
2966 static void do_periodic_work(struct b43_wldev *dev)
2967 {
2968         unsigned int state;
2969
2970         state = dev->periodic_state;
2971         if (state % 4 == 0)
2972                 b43_periodic_every60sec(dev);
2973         if (state % 2 == 0)
2974                 b43_periodic_every30sec(dev);
2975         b43_periodic_every15sec(dev);
2976 }
2977
2978 /* Periodic work locking policy:
2979  *      The whole periodic work handler is protected by
2980  *      wl->mutex. If another lock is needed somewhere in the
2981  *      pwork callchain, it's acquired in-place, where it's needed.
2982  */
2983 static void b43_periodic_work_handler(struct work_struct *work)
2984 {
2985         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2986                                              periodic_work.work);
2987         struct b43_wl *wl = dev->wl;
2988         unsigned long delay;
2989
2990         mutex_lock(&wl->mutex);
2991
2992         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2993                 goto out;
2994         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2995                 goto out_requeue;
2996
2997         do_periodic_work(dev);
2998
2999         dev->periodic_state++;
3000 out_requeue:
3001         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3002                 delay = msecs_to_jiffies(50);
3003         else
3004                 delay = round_jiffies_relative(HZ * 15);
3005         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3006 out:
3007         mutex_unlock(&wl->mutex);
3008 }
3009
3010 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3011 {
3012         struct delayed_work *work = &dev->periodic_work;
3013
3014         dev->periodic_state = 0;
3015         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3016         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3017 }
3018
3019 /* Check if communication with the device works correctly. */
3020 static int b43_validate_chipaccess(struct b43_wldev *dev)
3021 {
3022         u32 v, backup0, backup4;
3023
3024         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3025         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3026
3027         /* Check for read/write and endianness problems. */
3028         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3029         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3030                 goto error;
3031         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3032         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3033                 goto error;
3034
3035         /* Check if unaligned 32bit SHM_SHARED access works properly.
3036          * However, don't bail out on failure, because it's noncritical. */
3037         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3038         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3039         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3040         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3041         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3042                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3043         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3044         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3045             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3046             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3047             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3048                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3049
3050         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3051         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3052
3053         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3054                 /* The 32bit register shadows the two 16bit registers
3055                  * with update sideeffects. Validate this. */
3056                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3057                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3058                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3059                         goto error;
3060                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3061                         goto error;
3062         }
3063         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3064
3065         v = b43_read32(dev, B43_MMIO_MACCTL);
3066         v |= B43_MACCTL_GMODE;
3067         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3068                 goto error;
3069
3070         return 0;
3071 error:
3072         b43err(dev->wl, "Failed to validate the chipaccess\n");
3073         return -ENODEV;
3074 }
3075
3076 static void b43_security_init(struct b43_wldev *dev)
3077 {
3078         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3079         /* KTP is a word address, but we address SHM bytewise.
3080          * So multiply by two.
3081          */
3082         dev->ktp *= 2;
3083         /* Number of RCMTA address slots */
3084         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3085         /* Clear the key memory. */
3086         b43_clear_keys(dev);
3087 }
3088
3089 #ifdef CONFIG_B43_HWRNG
3090 static int b43_rng_read(struct hwrng *rng, u32 *data)
3091 {
3092         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3093         struct b43_wldev *dev;
3094         int count = -ENODEV;
3095
3096         mutex_lock(&wl->mutex);
3097         dev = wl->current_dev;
3098         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3099                 *data = b43_read16(dev, B43_MMIO_RNG);
3100                 count = sizeof(u16);
3101         }
3102         mutex_unlock(&wl->mutex);
3103
3104         return count;
3105 }
3106 #endif /* CONFIG_B43_HWRNG */
3107
3108 static void b43_rng_exit(struct b43_wl *wl)
3109 {
3110 #ifdef CONFIG_B43_HWRNG
3111         if (wl->rng_initialized)
3112                 hwrng_unregister(&wl->rng);
3113 #endif /* CONFIG_B43_HWRNG */
3114 }
3115
3116 static int b43_rng_init(struct b43_wl *wl)
3117 {
3118         int err = 0;
3119
3120 #ifdef CONFIG_B43_HWRNG
3121         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3122                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3123         wl->rng.name = wl->rng_name;
3124         wl->rng.data_read = b43_rng_read;
3125         wl->rng.priv = (unsigned long)wl;
3126         wl->rng_initialized = 1;
3127         err = hwrng_register(&wl->rng);
3128         if (err) {
3129                 wl->rng_initialized = 0;
3130                 b43err(wl, "Failed to register the random "
3131                        "number generator (%d)\n", err);
3132         }
3133 #endif /* CONFIG_B43_HWRNG */
3134
3135         return err;
3136 }
3137
3138 static void b43_tx_work(struct work_struct *work)
3139 {
3140         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3141         struct b43_wldev *dev;
3142         struct sk_buff *skb;
3143         int err = 0;
3144
3145         mutex_lock(&wl->mutex);
3146         dev = wl->current_dev;
3147         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3148                 mutex_unlock(&wl->mutex);
3149                 return;
3150         }
3151
3152         while (skb_queue_len(&wl->tx_queue)) {
3153                 skb = skb_dequeue(&wl->tx_queue);
3154
3155                 if (b43_using_pio_transfers(dev))
3156                         err = b43_pio_tx(dev, skb);
3157                 else
3158                         err = b43_dma_tx(dev, skb);
3159                 if (unlikely(err))
3160                         dev_kfree_skb(skb); /* Drop it */
3161         }
3162
3163 #if B43_DEBUG
3164         dev->tx_count++;
3165 #endif
3166         mutex_unlock(&wl->mutex);
3167 }
3168
3169 static int b43_op_tx(struct ieee80211_hw *hw,
3170                      struct sk_buff *skb)
3171 {
3172         struct b43_wl *wl = hw_to_b43_wl(hw);
3173
3174         if (unlikely(skb->len < 2 + 2 + 6)) {
3175                 /* Too short, this can't be a valid frame. */
3176                 dev_kfree_skb_any(skb);
3177                 return NETDEV_TX_OK;
3178         }
3179         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3180
3181         skb_queue_tail(&wl->tx_queue, skb);
3182         ieee80211_queue_work(wl->hw, &wl->tx_work);
3183
3184         return NETDEV_TX_OK;
3185 }
3186
3187 static void b43_qos_params_upload(struct b43_wldev *dev,
3188                                   const struct ieee80211_tx_queue_params *p,
3189                                   u16 shm_offset)
3190 {
3191         u16 params[B43_NR_QOSPARAMS];
3192         int bslots, tmp;
3193         unsigned int i;
3194
3195         if (!dev->qos_enabled)
3196                 return;
3197
3198         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3199
3200         memset(&params, 0, sizeof(params));
3201
3202         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3203         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3204         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3205         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3206         params[B43_QOSPARAM_AIFS] = p->aifs;
3207         params[B43_QOSPARAM_BSLOTS] = bslots;
3208         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3209
3210         for (i = 0; i < ARRAY_SIZE(params); i++) {
3211                 if (i == B43_QOSPARAM_STATUS) {
3212                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3213                                              shm_offset + (i * 2));
3214                         /* Mark the parameters as updated. */
3215                         tmp |= 0x100;
3216                         b43_shm_write16(dev, B43_SHM_SHARED,
3217                                         shm_offset + (i * 2),
3218                                         tmp);
3219                 } else {
3220                         b43_shm_write16(dev, B43_SHM_SHARED,
3221                                         shm_offset + (i * 2),
3222                                         params[i]);
3223                 }
3224         }
3225 }
3226
3227 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3228 static const u16 b43_qos_shm_offsets[] = {
3229         /* [mac80211-queue-nr] = SHM_OFFSET, */
3230         [0] = B43_QOS_VOICE,
3231         [1] = B43_QOS_VIDEO,
3232         [2] = B43_QOS_BESTEFFORT,
3233         [3] = B43_QOS_BACKGROUND,
3234 };
3235
3236 /* Update all QOS parameters in hardware. */
3237 static void b43_qos_upload_all(struct b43_wldev *dev)
3238 {
3239         struct b43_wl *wl = dev->wl;
3240         struct b43_qos_params *params;
3241         unsigned int i;
3242
3243         if (!dev->qos_enabled)
3244                 return;
3245
3246         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3247                      ARRAY_SIZE(wl->qos_params));
3248
3249         b43_mac_suspend(dev);
3250         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3251                 params = &(wl->qos_params[i]);
3252                 b43_qos_params_upload(dev, &(params->p),
3253                                       b43_qos_shm_offsets[i]);
3254         }
3255         b43_mac_enable(dev);
3256 }
3257
3258 static void b43_qos_clear(struct b43_wl *wl)
3259 {
3260         struct b43_qos_params *params;
3261         unsigned int i;
3262
3263         /* Initialize QoS parameters to sane defaults. */
3264
3265         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3266                      ARRAY_SIZE(wl->qos_params));
3267
3268         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3269                 params = &(wl->qos_params[i]);
3270
3271                 switch (b43_qos_shm_offsets[i]) {
3272                 case B43_QOS_VOICE:
3273                         params->p.txop = 0;
3274                         params->p.aifs = 2;
3275                         params->p.cw_min = 0x0001;
3276                         params->p.cw_max = 0x0001;
3277                         break;
3278                 case B43_QOS_VIDEO:
3279                         params->p.txop = 0;
3280                         params->p.aifs = 2;
3281                         params->p.cw_min = 0x0001;
3282                         params->p.cw_max = 0x0001;
3283                         break;
3284                 case B43_QOS_BESTEFFORT:
3285                         params->p.txop = 0;
3286                         params->p.aifs = 3;
3287                         params->p.cw_min = 0x0001;
3288                         params->p.cw_max = 0x03FF;
3289                         break;
3290                 case B43_QOS_BACKGROUND:
3291                         params->p.txop = 0;
3292                         params->p.aifs = 7;
3293                         params->p.cw_min = 0x0001;
3294                         params->p.cw_max = 0x03FF;
3295                         break;
3296                 default:
3297                         B43_WARN_ON(1);
3298                 }
3299         }
3300 }
3301
3302 /* Initialize the core's QOS capabilities */
3303 static void b43_qos_init(struct b43_wldev *dev)
3304 {
3305         if (!dev->qos_enabled) {
3306                 /* Disable QOS support. */
3307                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3308                 b43_write16(dev, B43_MMIO_IFSCTL,
3309                             b43_read16(dev, B43_MMIO_IFSCTL)
3310                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3311                 b43dbg(dev->wl, "QoS disabled\n");
3312                 return;
3313         }
3314
3315         /* Upload the current QOS parameters. */
3316         b43_qos_upload_all(dev);
3317
3318         /* Enable QOS support. */
3319         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3320         b43_write16(dev, B43_MMIO_IFSCTL,
3321                     b43_read16(dev, B43_MMIO_IFSCTL)
3322                     | B43_MMIO_IFSCTL_USE_EDCF);
3323         b43dbg(dev->wl, "QoS enabled\n");
3324 }
3325
3326 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3327                           const struct ieee80211_tx_queue_params *params)
3328 {
3329         struct b43_wl *wl = hw_to_b43_wl(hw);
3330         struct b43_wldev *dev;
3331         unsigned int queue = (unsigned int)_queue;
3332         int err = -ENODEV;
3333
3334         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3335                 /* Queue not available or don't support setting
3336                  * params on this queue. Return success to not
3337                  * confuse mac80211. */
3338                 return 0;
3339         }
3340         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3341                      ARRAY_SIZE(wl->qos_params));
3342
3343         mutex_lock(&wl->mutex);
3344         dev = wl->current_dev;
3345         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3346                 goto out_unlock;
3347
3348         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3349         b43_mac_suspend(dev);
3350         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3351                               b43_qos_shm_offsets[queue]);
3352         b43_mac_enable(dev);
3353         err = 0;
3354
3355 out_unlock:
3356         mutex_unlock(&wl->mutex);
3357
3358         return err;
3359 }
3360
3361 static int b43_op_get_stats(struct ieee80211_hw *hw,
3362                             struct ieee80211_low_level_stats *stats)
3363 {
3364         struct b43_wl *wl = hw_to_b43_wl(hw);
3365
3366         mutex_lock(&wl->mutex);
3367         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3368         mutex_unlock(&wl->mutex);
3369
3370         return 0;
3371 }
3372
3373 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3374 {
3375         struct b43_wl *wl = hw_to_b43_wl(hw);
3376         struct b43_wldev *dev;
3377         u64 tsf;
3378
3379         mutex_lock(&wl->mutex);
3380         dev = wl->current_dev;
3381
3382         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3383                 b43_tsf_read(dev, &tsf);
3384         else
3385                 tsf = 0;
3386
3387         mutex_unlock(&wl->mutex);
3388
3389         return tsf;
3390 }
3391
3392 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3393 {
3394         struct b43_wl *wl = hw_to_b43_wl(hw);
3395         struct b43_wldev *dev;
3396
3397         mutex_lock(&wl->mutex);
3398         dev = wl->current_dev;
3399
3400         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3401                 b43_tsf_write(dev, tsf);
3402
3403         mutex_unlock(&wl->mutex);
3404 }
3405
3406 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3407 {
3408         struct ssb_device *sdev = dev->dev;
3409         u32 tmslow;
3410
3411         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3412         tmslow &= ~B43_TMSLOW_GMODE;
3413         tmslow |= B43_TMSLOW_PHYRESET;
3414         tmslow |= SSB_TMSLOW_FGC;
3415         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3416         msleep(1);
3417
3418         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3419         tmslow &= ~SSB_TMSLOW_FGC;
3420         tmslow |= B43_TMSLOW_PHYRESET;
3421         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3422         msleep(1);
3423 }
3424
3425 static const char *band_to_string(enum ieee80211_band band)
3426 {
3427         switch (band) {
3428         case IEEE80211_BAND_5GHZ:
3429                 return "5";
3430         case IEEE80211_BAND_2GHZ:
3431                 return "2.4";
3432         default:
3433                 break;
3434         }
3435         B43_WARN_ON(1);
3436         return "";
3437 }
3438
3439 /* Expects wl->mutex locked */
3440 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3441 {
3442         struct b43_wldev *up_dev = NULL;
3443         struct b43_wldev *down_dev;
3444         struct b43_wldev *d;
3445         int err;
3446         bool uninitialized_var(gmode);
3447         int prev_status;
3448
3449         /* Find a device and PHY which supports the band. */
3450         list_for_each_entry(d, &wl->devlist, list) {
3451                 switch (chan->band) {
3452                 case IEEE80211_BAND_5GHZ:
3453                         if (d->phy.supports_5ghz) {
3454                                 up_dev = d;
3455                                 gmode = 0;
3456                         }
3457                         break;
3458                 case IEEE80211_BAND_2GHZ:
3459                         if (d->phy.supports_2ghz) {
3460                                 up_dev = d;
3461                                 gmode = 1;
3462                         }
3463                         break;
3464                 default:
3465                         B43_WARN_ON(1);
3466                         return -EINVAL;
3467                 }
3468                 if (up_dev)
3469                         break;
3470         }
3471         if (!up_dev) {
3472                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3473                        band_to_string(chan->band));
3474                 return -ENODEV;
3475         }
3476         if ((up_dev == wl->current_dev) &&
3477             (!!wl->current_dev->phy.gmode == !!gmode)) {
3478                 /* This device is already running. */
3479                 return 0;
3480         }
3481         b43dbg(wl, "Switching to %s-GHz band\n",
3482                band_to_string(chan->band));
3483         down_dev = wl->current_dev;
3484
3485         prev_status = b43_status(down_dev);
3486         /* Shutdown the currently running core. */
3487         if (prev_status >= B43_STAT_STARTED)
3488                 down_dev = b43_wireless_core_stop(down_dev);
3489         if (prev_status >= B43_STAT_INITIALIZED)
3490                 b43_wireless_core_exit(down_dev);
3491
3492         if (down_dev != up_dev) {
3493                 /* We switch to a different core, so we put PHY into
3494                  * RESET on the old core. */
3495                 b43_put_phy_into_reset(down_dev);
3496         }
3497
3498         /* Now start the new core. */
3499         up_dev->phy.gmode = gmode;
3500         if (prev_status >= B43_STAT_INITIALIZED) {
3501                 err = b43_wireless_core_init(up_dev);
3502                 if (err) {
3503                         b43err(wl, "Fatal: Could not initialize device for "
3504                                "selected %s-GHz band\n",
3505                                band_to_string(chan->band));
3506                         goto init_failure;
3507                 }
3508         }
3509         if (prev_status >= B43_STAT_STARTED) {
3510                 err = b43_wireless_core_start(up_dev);
3511                 if (err) {
3512                         b43err(wl, "Fatal: Coult not start device for "
3513                                "selected %s-GHz band\n",
3514                                band_to_string(chan->band));
3515                         b43_wireless_core_exit(up_dev);
3516                         goto init_failure;
3517                 }
3518         }
3519         B43_WARN_ON(b43_status(up_dev) != prev_status);
3520
3521         wl->current_dev = up_dev;
3522
3523         return 0;
3524 init_failure:
3525         /* Whoops, failed to init the new core. No core is operating now. */
3526         wl->current_dev = NULL;
3527         return err;
3528 }
3529
3530 /* Write the short and long frame retry limit values. */
3531 static void b43_set_retry_limits(struct b43_wldev *dev,
3532                                  unsigned int short_retry,
3533                                  unsigned int long_retry)
3534 {
3535         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3536          * the chip-internal counter. */
3537         short_retry = min(short_retry, (unsigned int)0xF);
3538         long_retry = min(long_retry, (unsigned int)0xF);
3539
3540         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3541                         short_retry);
3542         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3543                         long_retry);
3544 }
3545
3546 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3547 {
3548         struct b43_wl *wl = hw_to_b43_wl(hw);
3549         struct b43_wldev *dev;
3550         struct b43_phy *phy;
3551         struct ieee80211_conf *conf = &hw->conf;
3552         int antenna;
3553         int err = 0;
3554
3555         mutex_lock(&wl->mutex);
3556
3557         /* Switch the band (if necessary). This might change the active core. */
3558         err = b43_switch_band(wl, conf->channel);
3559         if (err)
3560                 goto out_unlock_mutex;
3561         dev = wl->current_dev;
3562         phy = &dev->phy;
3563
3564         if (conf_is_ht(conf))
3565                 phy->is_40mhz =
3566                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3567         else
3568                 phy->is_40mhz = false;
3569
3570         b43_mac_suspend(dev);
3571
3572         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3573                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3574                                           conf->long_frame_max_tx_count);
3575         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3576         if (!changed)
3577                 goto out_mac_enable;
3578
3579         /* Switch to the requested channel.
3580          * The firmware takes care of races with the TX handler. */
3581         if (conf->channel->hw_value != phy->channel)
3582                 b43_switch_channel(dev, conf->channel->hw_value);
3583
3584         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3585
3586         /* Adjust the desired TX power level. */
3587         if (conf->power_level != 0) {
3588                 if (conf->power_level != phy->desired_txpower) {
3589                         phy->desired_txpower = conf->power_level;
3590                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3591                                                    B43_TXPWR_IGNORE_TSSI);
3592                 }
3593         }
3594
3595         /* Antennas for RX and management frame TX. */
3596         antenna = B43_ANTENNA_DEFAULT;
3597         b43_mgmtframe_txantenna(dev, antenna);
3598         antenna = B43_ANTENNA_DEFAULT;
3599         if (phy->ops->set_rx_antenna)
3600                 phy->ops->set_rx_antenna(dev, antenna);
3601
3602         if (wl->radio_enabled != phy->radio_on) {
3603                 if (wl->radio_enabled) {
3604                         b43_software_rfkill(dev, false);
3605                         b43info(dev->wl, "Radio turned on by software\n");
3606                         if (!dev->radio_hw_enable) {
3607                                 b43info(dev->wl, "The hardware RF-kill button "
3608                                         "still turns the radio physically off. "
3609                                         "Press the button to turn it on.\n");
3610                         }
3611                 } else {
3612                         b43_software_rfkill(dev, true);
3613                         b43info(dev->wl, "Radio turned off by software\n");
3614                 }
3615         }
3616
3617 out_mac_enable:
3618         b43_mac_enable(dev);
3619 out_unlock_mutex:
3620         mutex_unlock(&wl->mutex);
3621
3622         return err;
3623 }
3624
3625 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3626 {
3627         struct ieee80211_supported_band *sband =
3628                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3629         struct ieee80211_rate *rate;
3630         int i;
3631         u16 basic, direct, offset, basic_offset, rateptr;
3632
3633         for (i = 0; i < sband->n_bitrates; i++) {
3634                 rate = &sband->bitrates[i];
3635
3636                 if (b43_is_cck_rate(rate->hw_value)) {
3637                         direct = B43_SHM_SH_CCKDIRECT;
3638                         basic = B43_SHM_SH_CCKBASIC;
3639                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3640                         offset &= 0xF;
3641                 } else {
3642                         direct = B43_SHM_SH_OFDMDIRECT;
3643                         basic = B43_SHM_SH_OFDMBASIC;
3644                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3645                         offset &= 0xF;
3646                 }
3647
3648                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3649
3650                 if (b43_is_cck_rate(rate->hw_value)) {
3651                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3652                         basic_offset &= 0xF;
3653                 } else {
3654                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3655                         basic_offset &= 0xF;
3656                 }
3657
3658                 /*
3659                  * Get the pointer that we need to point to
3660                  * from the direct map
3661                  */
3662                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3663                                          direct + 2 * basic_offset);
3664                 /* and write it to the basic map */
3665                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3666                                 rateptr);
3667         }
3668 }
3669
3670 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3671                                     struct ieee80211_vif *vif,
3672                                     struct ieee80211_bss_conf *conf,
3673                                     u32 changed)
3674 {
3675         struct b43_wl *wl = hw_to_b43_wl(hw);
3676         struct b43_wldev *dev;
3677
3678         mutex_lock(&wl->mutex);
3679
3680         dev = wl->current_dev;
3681         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3682                 goto out_unlock_mutex;
3683
3684         B43_WARN_ON(wl->vif != vif);
3685
3686         if (changed & BSS_CHANGED_BSSID) {
3687                 if (conf->bssid)
3688                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3689                 else
3690                         memset(wl->bssid, 0, ETH_ALEN);
3691         }
3692
3693         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3694                 if (changed & BSS_CHANGED_BEACON &&
3695                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3696                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3697                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3698                         b43_update_templates(wl);
3699
3700                 if (changed & BSS_CHANGED_BSSID)
3701                         b43_write_mac_bssid_templates(dev);
3702         }
3703
3704         b43_mac_suspend(dev);
3705
3706         /* Update templates for AP/mesh mode. */
3707         if (changed & BSS_CHANGED_BEACON_INT &&
3708             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3709              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3710              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3711                 b43_set_beacon_int(dev, conf->beacon_int);
3712
3713         if (changed & BSS_CHANGED_BASIC_RATES)
3714                 b43_update_basic_rates(dev, conf->basic_rates);
3715
3716         if (changed & BSS_CHANGED_ERP_SLOT) {
3717                 if (conf->use_short_slot)
3718                         b43_short_slot_timing_enable(dev);
3719                 else
3720                         b43_short_slot_timing_disable(dev);
3721         }
3722
3723         b43_mac_enable(dev);
3724 out_unlock_mutex:
3725         mutex_unlock(&wl->mutex);
3726 }
3727
3728 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3729                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3730                           struct ieee80211_key_conf *key)
3731 {
3732         struct b43_wl *wl = hw_to_b43_wl(hw);
3733         struct b43_wldev *dev;
3734         u8 algorithm;
3735         u8 index;
3736         int err;
3737         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3738
3739         if (modparam_nohwcrypt)
3740                 return -ENOSPC; /* User disabled HW-crypto */
3741
3742         mutex_lock(&wl->mutex);
3743
3744         dev = wl->current_dev;
3745         err = -ENODEV;
3746         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3747                 goto out_unlock;
3748
3749         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3750                 /* We don't have firmware for the crypto engine.
3751                  * Must use software-crypto. */
3752                 err = -EOPNOTSUPP;
3753                 goto out_unlock;
3754         }
3755
3756         err = -EINVAL;
3757         switch (key->alg) {
3758         case ALG_WEP:
3759                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3760                         algorithm = B43_SEC_ALGO_WEP40;
3761                 else
3762                         algorithm = B43_SEC_ALGO_WEP104;
3763                 break;
3764         case ALG_TKIP:
3765                 algorithm = B43_SEC_ALGO_TKIP;
3766                 break;
3767         case ALG_CCMP:
3768                 algorithm = B43_SEC_ALGO_AES;
3769                 break;
3770         default:
3771                 B43_WARN_ON(1);
3772                 goto out_unlock;
3773         }
3774         index = (u8) (key->keyidx);
3775         if (index > 3)
3776                 goto out_unlock;
3777
3778         switch (cmd) {
3779         case SET_KEY:
3780                 if (algorithm == B43_SEC_ALGO_TKIP &&
3781                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3782                     !modparam_hwtkip)) {
3783                         /* We support only pairwise key */
3784                         err = -EOPNOTSUPP;
3785                         goto out_unlock;
3786                 }
3787
3788                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3789                         if (WARN_ON(!sta)) {
3790                                 err = -EOPNOTSUPP;
3791                                 goto out_unlock;
3792                         }
3793                         /* Pairwise key with an assigned MAC address. */
3794                         err = b43_key_write(dev, -1, algorithm,
3795                                             key->key, key->keylen,
3796                                             sta->addr, key);
3797                 } else {
3798                         /* Group key */
3799                         err = b43_key_write(dev, index, algorithm,
3800                                             key->key, key->keylen, NULL, key);
3801                 }
3802                 if (err)
3803                         goto out_unlock;
3804
3805                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3806                     algorithm == B43_SEC_ALGO_WEP104) {
3807                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3808                 } else {
3809                         b43_hf_write(dev,
3810                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3811                 }
3812                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3813                 if (algorithm == B43_SEC_ALGO_TKIP)
3814                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3815                 break;
3816         case DISABLE_KEY: {
3817                 err = b43_key_clear(dev, key->hw_key_idx);
3818                 if (err)
3819                         goto out_unlock;
3820                 break;
3821         }
3822         default:
3823                 B43_WARN_ON(1);
3824         }
3825
3826 out_unlock:
3827         if (!err) {
3828                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3829                        "mac: %pM\n",
3830                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3831                        sta ? sta->addr : bcast_addr);
3832                 b43_dump_keymemory(dev);
3833         }
3834         mutex_unlock(&wl->mutex);
3835
3836         return err;
3837 }
3838
3839 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3840                                     unsigned int changed, unsigned int *fflags,
3841                                     u64 multicast)
3842 {
3843         struct b43_wl *wl = hw_to_b43_wl(hw);
3844         struct b43_wldev *dev;
3845
3846         mutex_lock(&wl->mutex);
3847         dev = wl->current_dev;
3848         if (!dev) {
3849                 *fflags = 0;
3850                 goto out_unlock;
3851         }
3852
3853         *fflags &= FIF_PROMISC_IN_BSS |
3854                   FIF_ALLMULTI |
3855                   FIF_FCSFAIL |
3856                   FIF_PLCPFAIL |
3857                   FIF_CONTROL |
3858                   FIF_OTHER_BSS |
3859                   FIF_BCN_PRBRESP_PROMISC;
3860
3861         changed &= FIF_PROMISC_IN_BSS |
3862                    FIF_ALLMULTI |
3863                    FIF_FCSFAIL |
3864                    FIF_PLCPFAIL |
3865                    FIF_CONTROL |
3866                    FIF_OTHER_BSS |
3867                    FIF_BCN_PRBRESP_PROMISC;
3868
3869         wl->filter_flags = *fflags;
3870
3871         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3872                 b43_adjust_opmode(dev);
3873
3874 out_unlock:
3875         mutex_unlock(&wl->mutex);
3876 }
3877
3878 /* Locking: wl->mutex
3879  * Returns the current dev. This might be different from the passed in dev,
3880  * because the core might be gone away while we unlocked the mutex. */
3881 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3882 {
3883         struct b43_wl *wl = dev->wl;
3884         struct b43_wldev *orig_dev;
3885         u32 mask;
3886
3887 redo:
3888         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3889                 return dev;
3890
3891         /* Cancel work. Unlock to avoid deadlocks. */
3892         mutex_unlock(&wl->mutex);
3893         cancel_delayed_work_sync(&dev->periodic_work);
3894         cancel_work_sync(&wl->tx_work);
3895         mutex_lock(&wl->mutex);
3896         dev = wl->current_dev;
3897         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3898                 /* Whoops, aliens ate up the device while we were unlocked. */
3899                 return dev;
3900         }
3901
3902         /* Disable interrupts on the device. */
3903         b43_set_status(dev, B43_STAT_INITIALIZED);
3904         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3905                 /* wl->mutex is locked. That is enough. */
3906                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3907                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3908         } else {
3909                 spin_lock_irq(&wl->hardirq_lock);
3910                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3911                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3912                 spin_unlock_irq(&wl->hardirq_lock);
3913         }
3914         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3915         orig_dev = dev;
3916         mutex_unlock(&wl->mutex);
3917         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3918                 b43_sdio_free_irq(dev);
3919         } else {
3920                 synchronize_irq(dev->dev->irq);
3921                 free_irq(dev->dev->irq, dev);
3922         }
3923         mutex_lock(&wl->mutex);
3924         dev = wl->current_dev;
3925         if (!dev)
3926                 return dev;
3927         if (dev != orig_dev) {
3928                 if (b43_status(dev) >= B43_STAT_STARTED)
3929                         goto redo;
3930                 return dev;
3931         }
3932         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
3933         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
3934
3935         /* Drain the TX queue */
3936         while (skb_queue_len(&wl->tx_queue))
3937                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
3938
3939         b43_mac_suspend(dev);
3940         b43_leds_exit(dev);
3941         b43dbg(wl, "Wireless interface stopped\n");
3942
3943         return dev;
3944 }
3945
3946 /* Locking: wl->mutex */
3947 static int b43_wireless_core_start(struct b43_wldev *dev)
3948 {
3949         int err;
3950
3951         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3952
3953         drain_txstatus_queue(dev);
3954         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3955                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
3956                 if (err) {
3957                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
3958                         goto out;
3959                 }
3960         } else {
3961                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
3962                                            b43_interrupt_thread_handler,
3963                                            IRQF_SHARED, KBUILD_MODNAME, dev);
3964                 if (err) {
3965                         b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3966                         goto out;
3967                 }
3968         }
3969
3970         /* We are ready to run. */
3971         ieee80211_wake_queues(dev->wl->hw);
3972         b43_set_status(dev, B43_STAT_STARTED);
3973
3974         /* Start data flow (TX/RX). */
3975         b43_mac_enable(dev);
3976         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3977
3978         /* Start maintainance work */
3979         b43_periodic_tasks_setup(dev);
3980
3981         b43_leds_init(dev);
3982
3983         b43dbg(dev->wl, "Wireless interface started\n");
3984 out:
3985         return err;
3986 }
3987
3988 /* Get PHY and RADIO versioning numbers */
3989 static int b43_phy_versioning(struct b43_wldev *dev)
3990 {
3991         struct b43_phy *phy = &dev->phy;
3992         u32 tmp;
3993         u8 analog_type;
3994         u8 phy_type;
3995         u8 phy_rev;
3996         u16 radio_manuf;
3997         u16 radio_ver;
3998         u16 radio_rev;
3999         int unsupported = 0;
4000
4001         /* Get PHY versioning */
4002         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4003         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4004         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4005         phy_rev = (tmp & B43_PHYVER_VERSION);
4006         switch (phy_type) {
4007         case B43_PHYTYPE_A:
4008                 if (phy_rev >= 4)
4009                         unsupported = 1;
4010                 break;
4011         case B43_PHYTYPE_B:
4012                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4013                     && phy_rev != 7)
4014                         unsupported = 1;
4015                 break;
4016         case B43_PHYTYPE_G:
4017                 if (phy_rev > 9)
4018                         unsupported = 1;
4019                 break;
4020 #ifdef CONFIG_B43_NPHY
4021         case B43_PHYTYPE_N:
4022                 if (phy_rev > 4)
4023                         unsupported = 1;
4024                 break;
4025 #endif
4026 #ifdef CONFIG_B43_PHY_LP
4027         case B43_PHYTYPE_LP:
4028                 if (phy_rev > 2)
4029                         unsupported = 1;
4030                 break;
4031 #endif
4032         default:
4033                 unsupported = 1;
4034         };
4035         if (unsupported) {
4036                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4037                        "(Analog %u, Type %u, Revision %u)\n",
4038                        analog_type, phy_type, phy_rev);
4039                 return -EOPNOTSUPP;
4040         }
4041         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4042                analog_type, phy_type, phy_rev);
4043
4044         /* Get RADIO versioning */
4045         if (dev->dev->bus->chip_id == 0x4317) {
4046                 if (dev->dev->bus->chip_rev == 0)
4047                         tmp = 0x3205017F;
4048                 else if (dev->dev->bus->chip_rev == 1)
4049                         tmp = 0x4205017F;
4050                 else
4051                         tmp = 0x5205017F;
4052         } else {
4053                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4054                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4055                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4056                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4057         }
4058         radio_manuf = (tmp & 0x00000FFF);
4059         radio_ver = (tmp & 0x0FFFF000) >> 12;
4060         radio_rev = (tmp & 0xF0000000) >> 28;
4061         if (radio_manuf != 0x17F /* Broadcom */)
4062                 unsupported = 1;
4063         switch (phy_type) {
4064         case B43_PHYTYPE_A:
4065                 if (radio_ver != 0x2060)
4066                         unsupported = 1;
4067                 if (radio_rev != 1)
4068                         unsupported = 1;
4069                 if (radio_manuf != 0x17F)
4070                         unsupported = 1;
4071                 break;
4072         case B43_PHYTYPE_B:
4073                 if ((radio_ver & 0xFFF0) != 0x2050)
4074                         unsupported = 1;
4075                 break;
4076         case B43_PHYTYPE_G:
4077                 if (radio_ver != 0x2050)
4078                         unsupported = 1;
4079                 break;
4080         case B43_PHYTYPE_N:
4081                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4082                         unsupported = 1;
4083                 break;
4084         case B43_PHYTYPE_LP:
4085                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4086                         unsupported = 1;
4087                 break;
4088         default:
4089                 B43_WARN_ON(1);
4090         }
4091         if (unsupported) {
4092                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4093                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4094                        radio_manuf, radio_ver, radio_rev);
4095                 return -EOPNOTSUPP;
4096         }
4097         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4098                radio_manuf, radio_ver, radio_rev);
4099
4100         phy->radio_manuf = radio_manuf;
4101         phy->radio_ver = radio_ver;
4102         phy->radio_rev = radio_rev;
4103
4104         phy->analog = analog_type;
4105         phy->type = phy_type;
4106         phy->rev = phy_rev;
4107
4108         return 0;
4109 }
4110
4111 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4112                                       struct b43_phy *phy)
4113 {
4114         phy->hardware_power_control = !!modparam_hwpctl;
4115         phy->next_txpwr_check_time = jiffies;
4116         /* PHY TX errors counter. */
4117         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4118
4119 #if B43_DEBUG
4120         phy->phy_locked = 0;
4121         phy->radio_locked = 0;
4122 #endif
4123 }
4124
4125 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4126 {
4127         dev->dfq_valid = 0;
4128
4129         /* Assume the radio is enabled. If it's not enabled, the state will
4130          * immediately get fixed on the first periodic work run. */
4131         dev->radio_hw_enable = 1;
4132
4133         /* Stats */
4134         memset(&dev->stats, 0, sizeof(dev->stats));
4135
4136         setup_struct_phy_for_init(dev, &dev->phy);
4137
4138         /* IRQ related flags */
4139         dev->irq_reason = 0;
4140         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4141         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4142         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4143                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4144
4145         dev->mac_suspended = 1;
4146
4147         /* Noise calculation context */
4148         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4149 }
4150
4151 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4152 {
4153         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
4154         u64 hf;
4155
4156         if (!modparam_btcoex)
4157                 return;
4158         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4159                 return;
4160         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4161                 return;
4162
4163         hf = b43_hf_read(dev);
4164         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4165                 hf |= B43_HF_BTCOEXALT;
4166         else
4167                 hf |= B43_HF_BTCOEX;
4168         b43_hf_write(dev, hf);
4169 }
4170
4171 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4172 {
4173         if (!modparam_btcoex)
4174                 return;
4175         //TODO
4176 }
4177
4178 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4179 {
4180 #ifdef CONFIG_SSB_DRIVER_PCICORE
4181         struct ssb_bus *bus = dev->dev->bus;
4182         u32 tmp;
4183
4184         if (bus->pcicore.dev &&
4185             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
4186             bus->pcicore.dev->id.revision <= 5) {
4187                 /* IMCFGLO timeouts workaround. */
4188                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
4189                 switch (bus->bustype) {
4190                 case SSB_BUSTYPE_PCI:
4191                 case SSB_BUSTYPE_PCMCIA:
4192                         tmp &= ~SSB_IMCFGLO_REQTO;
4193                         tmp &= ~SSB_IMCFGLO_SERTO;
4194                         tmp |= 0x32;
4195                         break;
4196                 case SSB_BUSTYPE_SSB:
4197                         tmp &= ~SSB_IMCFGLO_REQTO;
4198                         tmp &= ~SSB_IMCFGLO_SERTO;
4199                         tmp |= 0x53;
4200                         break;
4201                 default:
4202                         break;
4203                 }
4204                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
4205         }
4206 #endif /* CONFIG_SSB_DRIVER_PCICORE */
4207 }
4208
4209 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4210 {
4211         u16 pu_delay;
4212
4213         /* The time value is in microseconds. */
4214         if (dev->phy.type == B43_PHYTYPE_A)
4215                 pu_delay = 3700;
4216         else
4217                 pu_delay = 1050;
4218         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4219                 pu_delay = 500;
4220         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4221                 pu_delay = max(pu_delay, (u16)2400);
4222
4223         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4224 }
4225
4226 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4227 static void b43_set_pretbtt(struct b43_wldev *dev)
4228 {
4229         u16 pretbtt;
4230
4231         /* The time value is in microseconds. */
4232         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4233                 pretbtt = 2;
4234         } else {
4235                 if (dev->phy.type == B43_PHYTYPE_A)
4236                         pretbtt = 120;
4237                 else
4238                         pretbtt = 250;
4239         }
4240         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4241         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4242 }
4243
4244 /* Shutdown a wireless core */
4245 /* Locking: wl->mutex */
4246 static void b43_wireless_core_exit(struct b43_wldev *dev)
4247 {
4248         u32 macctl;
4249
4250         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4251         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4252                 return;
4253         b43_set_status(dev, B43_STAT_UNINIT);
4254
4255         /* Stop the microcode PSM. */
4256         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4257         macctl &= ~B43_MACCTL_PSM_RUN;
4258         macctl |= B43_MACCTL_PSM_JMP0;
4259         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4260
4261         b43_dma_free(dev);
4262         b43_pio_free(dev);
4263         b43_chip_exit(dev);
4264         dev->phy.ops->switch_analog(dev, 0);
4265         if (dev->wl->current_beacon) {
4266                 dev_kfree_skb_any(dev->wl->current_beacon);
4267                 dev->wl->current_beacon = NULL;
4268         }
4269
4270         ssb_device_disable(dev->dev, 0);
4271         ssb_bus_may_powerdown(dev->dev->bus);
4272 }
4273
4274 /* Initialize a wireless core */
4275 static int b43_wireless_core_init(struct b43_wldev *dev)
4276 {
4277         struct ssb_bus *bus = dev->dev->bus;
4278         struct ssb_sprom *sprom = &bus->sprom;
4279         struct b43_phy *phy = &dev->phy;
4280         int err;
4281         u64 hf;
4282         u32 tmp;
4283
4284         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4285
4286         err = ssb_bus_powerup(bus, 0);
4287         if (err)
4288                 goto out;
4289         if (!ssb_device_is_enabled(dev->dev)) {
4290                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4291                 b43_wireless_core_reset(dev, tmp);
4292         }
4293
4294         /* Reset all data structures. */
4295         setup_struct_wldev_for_init(dev);
4296         phy->ops->prepare_structs(dev);
4297
4298         /* Enable IRQ routing to this device. */
4299         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4300
4301         b43_imcfglo_timeouts_workaround(dev);
4302         b43_bluetooth_coext_disable(dev);
4303         if (phy->ops->prepare_hardware) {
4304                 err = phy->ops->prepare_hardware(dev);
4305                 if (err)
4306                         goto err_busdown;
4307         }
4308         err = b43_chip_init(dev);
4309         if (err)
4310                 goto err_busdown;
4311         b43_shm_write16(dev, B43_SHM_SHARED,
4312                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4313         hf = b43_hf_read(dev);
4314         if (phy->type == B43_PHYTYPE_G) {
4315                 hf |= B43_HF_SYMW;
4316                 if (phy->rev == 1)
4317                         hf |= B43_HF_GDCW;
4318                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4319                         hf |= B43_HF_OFDMPABOOST;
4320         }
4321         if (phy->radio_ver == 0x2050) {
4322                 if (phy->radio_rev == 6)
4323                         hf |= B43_HF_4318TSSI;
4324                 if (phy->radio_rev < 6)
4325                         hf |= B43_HF_VCORECALC;
4326         }
4327         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4328                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4329 #ifdef CONFIG_SSB_DRIVER_PCICORE
4330         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4331             (bus->pcicore.dev->id.revision <= 10))
4332                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4333 #endif
4334         hf &= ~B43_HF_SKCFPUP;
4335         b43_hf_write(dev, hf);
4336
4337         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4338                              B43_DEFAULT_LONG_RETRY_LIMIT);
4339         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4340         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4341
4342         /* Disable sending probe responses from firmware.
4343          * Setting the MaxTime to one usec will always trigger
4344          * a timeout, so we never send any probe resp.
4345          * A timeout of zero is infinite. */
4346         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4347
4348         b43_rate_memory_init(dev);
4349         b43_set_phytxctl_defaults(dev);
4350
4351         /* Minimum Contention Window */
4352         if (phy->type == B43_PHYTYPE_B)
4353                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4354         else
4355                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4356         /* Maximum Contention Window */
4357         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4358
4359         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
4360             (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) ||
4361             dev->use_pio) {
4362                 dev->__using_pio_transfers = 1;
4363                 err = b43_pio_init(dev);
4364         } else {
4365                 dev->__using_pio_transfers = 0;
4366                 err = b43_dma_init(dev);
4367         }
4368         if (err)
4369                 goto err_chip_exit;
4370         b43_qos_init(dev);
4371         b43_set_synth_pu_delay(dev, 1);
4372         b43_bluetooth_coext_enable(dev);
4373
4374         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4375         b43_upload_card_macaddress(dev);
4376         b43_security_init(dev);
4377
4378         ieee80211_wake_queues(dev->wl->hw);
4379
4380         b43_set_status(dev, B43_STAT_INITIALIZED);
4381
4382 out:
4383         return err;
4384
4385 err_chip_exit:
4386         b43_chip_exit(dev);
4387 err_busdown:
4388         ssb_bus_may_powerdown(bus);
4389         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4390         return err;
4391 }
4392
4393 static int b43_op_add_interface(struct ieee80211_hw *hw,
4394                                 struct ieee80211_vif *vif)
4395 {
4396         struct b43_wl *wl = hw_to_b43_wl(hw);
4397         struct b43_wldev *dev;
4398         int err = -EOPNOTSUPP;
4399
4400         /* TODO: allow WDS/AP devices to coexist */
4401
4402         if (vif->type != NL80211_IFTYPE_AP &&
4403             vif->type != NL80211_IFTYPE_MESH_POINT &&
4404             vif->type != NL80211_IFTYPE_STATION &&
4405             vif->type != NL80211_IFTYPE_WDS &&
4406             vif->type != NL80211_IFTYPE_ADHOC)
4407                 return -EOPNOTSUPP;
4408
4409         mutex_lock(&wl->mutex);
4410         if (wl->operating)
4411                 goto out_mutex_unlock;
4412
4413         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4414
4415         dev = wl->current_dev;
4416         wl->operating = 1;
4417         wl->vif = vif;
4418         wl->if_type = vif->type;
4419         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4420
4421         b43_adjust_opmode(dev);
4422         b43_set_pretbtt(dev);
4423         b43_set_synth_pu_delay(dev, 0);
4424         b43_upload_card_macaddress(dev);
4425
4426         err = 0;
4427  out_mutex_unlock:
4428         mutex_unlock(&wl->mutex);
4429
4430         return err;
4431 }
4432
4433 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4434                                     struct ieee80211_vif *vif)
4435 {
4436         struct b43_wl *wl = hw_to_b43_wl(hw);
4437         struct b43_wldev *dev = wl->current_dev;
4438
4439         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4440
4441         mutex_lock(&wl->mutex);
4442
4443         B43_WARN_ON(!wl->operating);
4444         B43_WARN_ON(wl->vif != vif);
4445         wl->vif = NULL;
4446
4447         wl->operating = 0;
4448
4449         b43_adjust_opmode(dev);
4450         memset(wl->mac_addr, 0, ETH_ALEN);
4451         b43_upload_card_macaddress(dev);
4452
4453         mutex_unlock(&wl->mutex);
4454 }
4455
4456 static int b43_op_start(struct ieee80211_hw *hw)
4457 {
4458         struct b43_wl *wl = hw_to_b43_wl(hw);
4459         struct b43_wldev *dev = wl->current_dev;
4460         int did_init = 0;
4461         int err = 0;
4462
4463         /* Kill all old instance specific information to make sure
4464          * the card won't use it in the short timeframe between start
4465          * and mac80211 reconfiguring it. */
4466         memset(wl->bssid, 0, ETH_ALEN);
4467         memset(wl->mac_addr, 0, ETH_ALEN);
4468         wl->filter_flags = 0;
4469         wl->radiotap_enabled = 0;
4470         b43_qos_clear(wl);
4471         wl->beacon0_uploaded = 0;
4472         wl->beacon1_uploaded = 0;
4473         wl->beacon_templates_virgin = 1;
4474         wl->radio_enabled = 1;
4475
4476         mutex_lock(&wl->mutex);
4477
4478         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4479                 err = b43_wireless_core_init(dev);
4480                 if (err)
4481                         goto out_mutex_unlock;
4482                 did_init = 1;
4483         }
4484
4485         if (b43_status(dev) < B43_STAT_STARTED) {
4486                 err = b43_wireless_core_start(dev);
4487                 if (err) {
4488                         if (did_init)
4489                                 b43_wireless_core_exit(dev);
4490                         goto out_mutex_unlock;
4491                 }
4492         }
4493
4494         /* XXX: only do if device doesn't support rfkill irq */
4495         wiphy_rfkill_start_polling(hw->wiphy);
4496
4497  out_mutex_unlock:
4498         mutex_unlock(&wl->mutex);
4499
4500         return err;
4501 }
4502
4503 static void b43_op_stop(struct ieee80211_hw *hw)
4504 {
4505         struct b43_wl *wl = hw_to_b43_wl(hw);
4506         struct b43_wldev *dev = wl->current_dev;
4507
4508         cancel_work_sync(&(wl->beacon_update_trigger));
4509
4510         mutex_lock(&wl->mutex);
4511         if (b43_status(dev) >= B43_STAT_STARTED) {
4512                 dev = b43_wireless_core_stop(dev);
4513                 if (!dev)
4514                         goto out_unlock;
4515         }
4516         b43_wireless_core_exit(dev);
4517         wl->radio_enabled = 0;
4518
4519 out_unlock:
4520         mutex_unlock(&wl->mutex);
4521
4522         cancel_work_sync(&(wl->txpower_adjust_work));
4523 }
4524
4525 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4526                                  struct ieee80211_sta *sta, bool set)
4527 {
4528         struct b43_wl *wl = hw_to_b43_wl(hw);
4529
4530         /* FIXME: add locking */
4531         b43_update_templates(wl);
4532
4533         return 0;
4534 }
4535
4536 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4537                               struct ieee80211_vif *vif,
4538                               enum sta_notify_cmd notify_cmd,
4539                               struct ieee80211_sta *sta)
4540 {
4541         struct b43_wl *wl = hw_to_b43_wl(hw);
4542
4543         B43_WARN_ON(!vif || wl->vif != vif);
4544 }
4545
4546 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4547 {
4548         struct b43_wl *wl = hw_to_b43_wl(hw);
4549         struct b43_wldev *dev;
4550
4551         mutex_lock(&wl->mutex);
4552         dev = wl->current_dev;
4553         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4554                 /* Disable CFP update during scan on other channels. */
4555                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4556         }
4557         mutex_unlock(&wl->mutex);
4558 }
4559
4560 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4561 {
4562         struct b43_wl *wl = hw_to_b43_wl(hw);
4563         struct b43_wldev *dev;
4564
4565         mutex_lock(&wl->mutex);
4566         dev = wl->current_dev;
4567         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4568                 /* Re-enable CFP update. */
4569                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4570         }
4571         mutex_unlock(&wl->mutex);
4572 }
4573
4574 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4575                              struct survey_info *survey)
4576 {
4577         struct b43_wl *wl = hw_to_b43_wl(hw);
4578         struct b43_wldev *dev = wl->current_dev;
4579         struct ieee80211_conf *conf = &hw->conf;
4580
4581         if (idx != 0)
4582                 return -ENOENT;
4583
4584         survey->channel = conf->channel;
4585         survey->filled = SURVEY_INFO_NOISE_DBM;
4586         survey->noise = dev->stats.link_noise;
4587
4588         return 0;
4589 }
4590
4591 static const struct ieee80211_ops b43_hw_ops = {
4592         .tx                     = b43_op_tx,
4593         .conf_tx                = b43_op_conf_tx,
4594         .add_interface          = b43_op_add_interface,
4595         .remove_interface       = b43_op_remove_interface,
4596         .config                 = b43_op_config,
4597         .bss_info_changed       = b43_op_bss_info_changed,
4598         .configure_filter       = b43_op_configure_filter,
4599         .set_key                = b43_op_set_key,
4600         .update_tkip_key        = b43_op_update_tkip_key,
4601         .get_stats              = b43_op_get_stats,
4602         .get_tsf                = b43_op_get_tsf,
4603         .set_tsf                = b43_op_set_tsf,
4604         .start                  = b43_op_start,
4605         .stop                   = b43_op_stop,
4606         .set_tim                = b43_op_beacon_set_tim,
4607         .sta_notify             = b43_op_sta_notify,
4608         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4609         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4610         .get_survey             = b43_op_get_survey,
4611         .rfkill_poll            = b43_rfkill_poll,
4612 };
4613
4614 /* Hard-reset the chip. Do not call this directly.
4615  * Use b43_controller_restart()
4616  */
4617 static void b43_chip_reset(struct work_struct *work)
4618 {
4619         struct b43_wldev *dev =
4620             container_of(work, struct b43_wldev, restart_work);
4621         struct b43_wl *wl = dev->wl;
4622         int err = 0;
4623         int prev_status;
4624
4625         mutex_lock(&wl->mutex);
4626
4627         prev_status = b43_status(dev);
4628         /* Bring the device down... */
4629         if (prev_status >= B43_STAT_STARTED) {
4630                 dev = b43_wireless_core_stop(dev);
4631                 if (!dev) {
4632                         err = -ENODEV;
4633                         goto out;
4634                 }
4635         }
4636         if (prev_status >= B43_STAT_INITIALIZED)
4637                 b43_wireless_core_exit(dev);
4638
4639         /* ...and up again. */
4640         if (prev_status >= B43_STAT_INITIALIZED) {
4641                 err = b43_wireless_core_init(dev);
4642                 if (err)
4643                         goto out;
4644         }
4645         if (prev_status >= B43_STAT_STARTED) {
4646                 err = b43_wireless_core_start(dev);
4647                 if (err) {
4648                         b43_wireless_core_exit(dev);
4649                         goto out;
4650                 }
4651         }
4652 out:
4653         if (err)
4654                 wl->current_dev = NULL; /* Failed to init the dev. */
4655         mutex_unlock(&wl->mutex);
4656         if (err)
4657                 b43err(wl, "Controller restart FAILED\n");
4658         else
4659                 b43info(wl, "Controller restarted\n");
4660 }
4661
4662 static int b43_setup_bands(struct b43_wldev *dev,
4663                            bool have_2ghz_phy, bool have_5ghz_phy)
4664 {
4665         struct ieee80211_hw *hw = dev->wl->hw;
4666
4667         if (have_2ghz_phy)
4668                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4669         if (dev->phy.type == B43_PHYTYPE_N) {
4670                 if (have_5ghz_phy)
4671                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4672         } else {
4673                 if (have_5ghz_phy)
4674                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4675         }
4676
4677         dev->phy.supports_2ghz = have_2ghz_phy;
4678         dev->phy.supports_5ghz = have_5ghz_phy;
4679
4680         return 0;
4681 }
4682
4683 static void b43_wireless_core_detach(struct b43_wldev *dev)
4684 {
4685         /* We release firmware that late to not be required to re-request
4686          * is all the time when we reinit the core. */
4687         b43_release_firmware(dev);
4688         b43_phy_free(dev);
4689 }
4690
4691 static int b43_wireless_core_attach(struct b43_wldev *dev)
4692 {
4693         struct b43_wl *wl = dev->wl;
4694         struct ssb_bus *bus = dev->dev->bus;
4695         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4696         int err;
4697         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4698         u32 tmp;
4699
4700         /* Do NOT do any device initialization here.
4701          * Do it in wireless_core_init() instead.
4702          * This function is for gathering basic information about the HW, only.
4703          * Also some structs may be set up here. But most likely you want to have
4704          * that in core_init(), too.
4705          */
4706
4707         err = ssb_bus_powerup(bus, 0);
4708         if (err) {
4709                 b43err(wl, "Bus powerup failed\n");
4710                 goto out;
4711         }
4712         /* Get the PHY type. */
4713         if (dev->dev->id.revision >= 5) {
4714                 u32 tmshigh;
4715
4716                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4717                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4718                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4719         } else
4720                 B43_WARN_ON(1);
4721
4722         dev->phy.gmode = have_2ghz_phy;
4723         dev->phy.radio_on = 1;
4724         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4725         b43_wireless_core_reset(dev, tmp);
4726
4727         err = b43_phy_versioning(dev);
4728         if (err)
4729                 goto err_powerdown;
4730         /* Check if this device supports multiband. */
4731         if (!pdev ||
4732             (pdev->device != 0x4312 &&
4733              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4734                 /* No multiband support. */
4735                 have_2ghz_phy = 0;
4736                 have_5ghz_phy = 0;
4737                 switch (dev->phy.type) {
4738                 case B43_PHYTYPE_A:
4739                         have_5ghz_phy = 1;
4740                         break;
4741                 case B43_PHYTYPE_LP: //FIXME not always!
4742 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4743                         have_5ghz_phy = 1;
4744 #endif
4745                 case B43_PHYTYPE_G:
4746                 case B43_PHYTYPE_N:
4747                         have_2ghz_phy = 1;
4748                         break;
4749                 default:
4750                         B43_WARN_ON(1);
4751                 }
4752         }
4753         if (dev->phy.type == B43_PHYTYPE_A) {
4754                 /* FIXME */
4755                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4756                 err = -EOPNOTSUPP;
4757                 goto err_powerdown;
4758         }
4759         if (1 /* disable A-PHY */) {
4760                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4761                 if (dev->phy.type != B43_PHYTYPE_N &&
4762                     dev->phy.type != B43_PHYTYPE_LP) {
4763                         have_2ghz_phy = 1;
4764                         have_5ghz_phy = 0;
4765                 }
4766         }
4767
4768         err = b43_phy_allocate(dev);
4769         if (err)
4770                 goto err_powerdown;
4771
4772         dev->phy.gmode = have_2ghz_phy;
4773         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4774         b43_wireless_core_reset(dev, tmp);
4775
4776         err = b43_validate_chipaccess(dev);
4777         if (err)
4778                 goto err_phy_free;
4779         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4780         if (err)
4781                 goto err_phy_free;
4782
4783         /* Now set some default "current_dev" */
4784         if (!wl->current_dev)
4785                 wl->current_dev = dev;
4786         INIT_WORK(&dev->restart_work, b43_chip_reset);
4787
4788         dev->phy.ops->switch_analog(dev, 0);
4789         ssb_device_disable(dev->dev, 0);
4790         ssb_bus_may_powerdown(bus);
4791
4792 out:
4793         return err;
4794
4795 err_phy_free:
4796         b43_phy_free(dev);
4797 err_powerdown:
4798         ssb_bus_may_powerdown(bus);
4799         return err;
4800 }
4801
4802 static void b43_one_core_detach(struct ssb_device *dev)
4803 {
4804         struct b43_wldev *wldev;
4805         struct b43_wl *wl;
4806
4807         /* Do not cancel ieee80211-workqueue based work here.
4808          * See comment in b43_remove(). */
4809
4810         wldev = ssb_get_drvdata(dev);
4811         wl = wldev->wl;
4812         b43_debugfs_remove_device(wldev);
4813         b43_wireless_core_detach(wldev);
4814         list_del(&wldev->list);
4815         wl->nr_devs--;
4816         ssb_set_drvdata(dev, NULL);
4817         kfree(wldev);
4818 }
4819
4820 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4821 {
4822         struct b43_wldev *wldev;
4823         struct pci_dev *pdev;
4824         int err = -ENOMEM;
4825
4826         if (!list_empty(&wl->devlist)) {
4827                 /* We are not the first core on this chip. */
4828                 pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
4829                 /* Only special chips support more than one wireless
4830                  * core, although some of the other chips have more than
4831                  * one wireless core as well. Check for this and
4832                  * bail out early.
4833                  */
4834                 if (!pdev ||
4835                     ((pdev->device != 0x4321) &&
4836                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4837                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4838                         return -ENODEV;
4839                 }
4840         }
4841
4842         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4843         if (!wldev)
4844                 goto out;
4845
4846         wldev->use_pio = b43_modparam_pio;
4847         wldev->dev = dev;
4848         wldev->wl = wl;
4849         b43_set_status(wldev, B43_STAT_UNINIT);
4850         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4851         INIT_LIST_HEAD(&wldev->list);
4852
4853         err = b43_wireless_core_attach(wldev);
4854         if (err)
4855                 goto err_kfree_wldev;
4856
4857         list_add(&wldev->list, &wl->devlist);
4858         wl->nr_devs++;
4859         ssb_set_drvdata(dev, wldev);
4860         b43_debugfs_add_device(wldev);
4861
4862       out:
4863         return err;
4864
4865       err_kfree_wldev:
4866         kfree(wldev);
4867         return err;
4868 }
4869
4870 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4871         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4872         (pdev->device == _device) &&                                    \
4873         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4874         (pdev->subsystem_device == _subdevice)                          )
4875
4876 static void b43_sprom_fixup(struct ssb_bus *bus)
4877 {
4878         struct pci_dev *pdev;
4879
4880         /* boardflags workarounds */
4881         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4882             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4883                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4884         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4885             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4886                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4887         if (bus->bustype == SSB_BUSTYPE_PCI) {
4888                 pdev = bus->host_pci;
4889                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4890                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4891                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4892                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4893                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4894                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4895                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4896                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4897         }
4898 }
4899
4900 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4901 {
4902         struct ieee80211_hw *hw = wl->hw;
4903
4904         ssb_set_devtypedata(dev, NULL);
4905         ieee80211_free_hw(hw);
4906 }
4907
4908 static int b43_wireless_init(struct ssb_device *dev)
4909 {
4910         struct ssb_sprom *sprom = &dev->bus->sprom;
4911         struct ieee80211_hw *hw;
4912         struct b43_wl *wl;
4913         int err = -ENOMEM;
4914
4915         b43_sprom_fixup(dev->bus);
4916
4917         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4918         if (!hw) {
4919                 b43err(NULL, "Could not allocate ieee80211 device\n");
4920                 goto out;
4921         }
4922         wl = hw_to_b43_wl(hw);
4923
4924         /* fill hw info */
4925         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4926                     IEEE80211_HW_SIGNAL_DBM;
4927
4928         hw->wiphy->interface_modes =
4929                 BIT(NL80211_IFTYPE_AP) |
4930                 BIT(NL80211_IFTYPE_MESH_POINT) |
4931                 BIT(NL80211_IFTYPE_STATION) |
4932                 BIT(NL80211_IFTYPE_WDS) |
4933                 BIT(NL80211_IFTYPE_ADHOC);
4934
4935         hw->queues = modparam_qos ? 4 : 1;
4936         wl->mac80211_initially_registered_queues = hw->queues;
4937         hw->max_rates = 2;
4938         SET_IEEE80211_DEV(hw, dev->dev);
4939         if (is_valid_ether_addr(sprom->et1mac))
4940                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4941         else
4942                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4943
4944         /* Initialize struct b43_wl */
4945         wl->hw = hw;
4946         mutex_init(&wl->mutex);
4947         spin_lock_init(&wl->hardirq_lock);
4948         INIT_LIST_HEAD(&wl->devlist);
4949         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4950         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4951         INIT_WORK(&wl->tx_work, b43_tx_work);
4952         skb_queue_head_init(&wl->tx_queue);
4953
4954         ssb_set_devtypedata(dev, wl);
4955         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4956                 dev->bus->chip_id, dev->id.revision);
4957         err = 0;
4958 out:
4959         return err;
4960 }
4961
4962 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4963 {
4964         struct b43_wl *wl;
4965         int err;
4966         int first = 0;
4967
4968         wl = ssb_get_devtypedata(dev);
4969         if (!wl) {
4970                 /* Probing the first core. Must setup common struct b43_wl */
4971                 first = 1;
4972                 err = b43_wireless_init(dev);
4973                 if (err)
4974                         goto out;
4975                 wl = ssb_get_devtypedata(dev);
4976                 B43_WARN_ON(!wl);
4977         }
4978         err = b43_one_core_attach(dev, wl);
4979         if (err)
4980                 goto err_wireless_exit;
4981
4982         if (first) {
4983                 err = ieee80211_register_hw(wl->hw);
4984                 if (err)
4985                         goto err_one_core_detach;
4986                 b43_leds_register(wl->current_dev);
4987                 b43_rng_init(wl);
4988         }
4989
4990       out:
4991         return err;
4992
4993       err_one_core_detach:
4994         b43_one_core_detach(dev);
4995       err_wireless_exit:
4996         if (first)
4997                 b43_wireless_exit(dev, wl);
4998         return err;
4999 }
5000
5001 static void b43_remove(struct ssb_device *dev)
5002 {
5003         struct b43_wl *wl = ssb_get_devtypedata(dev);
5004         struct b43_wldev *wldev = ssb_get_drvdata(dev);
5005
5006         /* We must cancel any work here before unregistering from ieee80211,
5007          * as the ieee80211 unreg will destroy the workqueue. */
5008         cancel_work_sync(&wldev->restart_work);
5009
5010         B43_WARN_ON(!wl);
5011         if (wl->current_dev == wldev) {
5012                 /* Restore the queues count before unregistering, because firmware detect
5013                  * might have modified it. Restoring is important, so the networking
5014                  * stack can properly free resources. */
5015                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5016                 b43_leds_stop(wldev);
5017                 ieee80211_unregister_hw(wl->hw);
5018         }
5019
5020         b43_one_core_detach(dev);
5021
5022         if (list_empty(&wl->devlist)) {
5023                 b43_rng_exit(wl);
5024                 b43_leds_unregister(wl);
5025                 /* Last core on the chip unregistered.
5026                  * We can destroy common struct b43_wl.
5027                  */
5028                 b43_wireless_exit(dev, wl);
5029         }
5030 }
5031
5032 /* Perform a hardware reset. This can be called from any context. */
5033 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5034 {
5035         /* Must avoid requeueing, if we are in shutdown. */
5036         if (b43_status(dev) < B43_STAT_INITIALIZED)
5037                 return;
5038         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5039         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5040 }
5041
5042 static struct ssb_driver b43_ssb_driver = {
5043         .name           = KBUILD_MODNAME,
5044         .id_table       = b43_ssb_tbl,
5045         .probe          = b43_probe,
5046         .remove         = b43_remove,
5047 };
5048
5049 static void b43_print_driverinfo(void)
5050 {
5051         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5052                    *feat_leds = "", *feat_sdio = "";
5053
5054 #ifdef CONFIG_B43_PCI_AUTOSELECT
5055         feat_pci = "P";
5056 #endif
5057 #ifdef CONFIG_B43_PCMCIA
5058         feat_pcmcia = "M";
5059 #endif
5060 #ifdef CONFIG_B43_NPHY
5061         feat_nphy = "N";
5062 #endif
5063 #ifdef CONFIG_B43_LEDS
5064         feat_leds = "L";
5065 #endif
5066 #ifdef CONFIG_B43_SDIO
5067         feat_sdio = "S";
5068 #endif
5069         printk(KERN_INFO "Broadcom 43xx driver loaded "
5070                "[ Features: %s%s%s%s%s, Firmware-ID: "
5071                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5072                feat_pci, feat_pcmcia, feat_nphy,
5073                feat_leds, feat_sdio);
5074 }
5075
5076 static int __init b43_init(void)
5077 {
5078         int err;
5079
5080         b43_debugfs_init();
5081         err = b43_pcmcia_init();
5082         if (err)
5083                 goto err_dfs_exit;
5084         err = b43_sdio_init();
5085         if (err)
5086                 goto err_pcmcia_exit;
5087         err = ssb_driver_register(&b43_ssb_driver);
5088         if (err)
5089                 goto err_sdio_exit;
5090         b43_print_driverinfo();
5091
5092         return err;
5093
5094 err_sdio_exit:
5095         b43_sdio_exit();
5096 err_pcmcia_exit:
5097         b43_pcmcia_exit();
5098 err_dfs_exit:
5099         b43_debugfs_exit();
5100         return err;
5101 }
5102
5103 static void __exit b43_exit(void)
5104 {
5105         ssb_driver_unregister(&b43_ssb_driver);
5106         b43_sdio_exit();
5107         b43_pcmcia_exit();
5108         b43_debugfs_exit();
5109 }
5110
5111 module_init(b43_init)
5112 module_exit(b43_exit)