b43: Declare at least one real firmware file using MODULE_FIRMWARE.
[pandora-kernel.git] / drivers / net / wireless / b43 / main.c
1 /*
2
3   Broadcom B43 wireless driver
4
5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11   SDIO support
12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
13
14   Some parts of the code in this file are derived from the ipw2200
15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
16
17   This program is free software; you can redistribute it and/or modify
18   it under the terms of the GNU General Public License as published by
19   the Free Software Foundation; either version 2 of the License, or
20   (at your option) any later version.
21
22   This program is distributed in the hope that it will be useful,
23   but WITHOUT ANY WARRANTY; without even the implied warranty of
24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25   GNU General Public License for more details.
26
27   You should have received a copy of the GNU General Public License
28   along with this program; see the file COPYING.  If not, write to
29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
30   Boston, MA 02110-1301, USA.
31
32 */
33
34 #include <linux/delay.h>
35 #include <linux/init.h>
36 #include <linux/moduleparam.h>
37 #include <linux/if_arp.h>
38 #include <linux/etherdevice.h>
39 #include <linux/firmware.h>
40 #include <linux/wireless.h>
41 #include <linux/workqueue.h>
42 #include <linux/skbuff.h>
43 #include <linux/io.h>
44 #include <linux/dma-mapping.h>
45 #include <asm/unaligned.h>
46
47 #include "b43.h"
48 #include "main.h"
49 #include "debugfs.h"
50 #include "phy_common.h"
51 #include "phy_g.h"
52 #include "phy_n.h"
53 #include "dma.h"
54 #include "pio.h"
55 #include "sysfs.h"
56 #include "xmit.h"
57 #include "lo.h"
58 #include "pcmcia.h"
59 #include "sdio.h"
60 #include <linux/mmc/sdio_func.h>
61
62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
63 MODULE_AUTHOR("Martin Langer");
64 MODULE_AUTHOR("Stefano Brivio");
65 MODULE_AUTHOR("Michael Buesch");
66 MODULE_AUTHOR("Gábor Stefanik");
67 MODULE_LICENSE("GPL");
68
69 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
70 MODULE_FIRMWARE("b43/ucode11.fw");
71 MODULE_FIRMWARE("b43/ucode13.fw");
72 MODULE_FIRMWARE("b43/ucode14.fw");
73 MODULE_FIRMWARE("b43/ucode15.fw");
74 MODULE_FIRMWARE("b43/ucode5.fw");
75 MODULE_FIRMWARE("b43/ucode9.fw");
76
77 static int modparam_bad_frames_preempt;
78 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
79 MODULE_PARM_DESC(bad_frames_preempt,
80                  "enable(1) / disable(0) Bad Frames Preemption");
81
82 static char modparam_fwpostfix[16];
83 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
84 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
85
86 static int modparam_hwpctl;
87 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
88 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
89
90 static int modparam_nohwcrypt;
91 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
92 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
93
94 static int modparam_hwtkip;
95 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
96 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
97
98 static int modparam_qos = 1;
99 module_param_named(qos, modparam_qos, int, 0444);
100 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
101
102 static int modparam_btcoex = 1;
103 module_param_named(btcoex, modparam_btcoex, int, 0444);
104 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
105
106 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
107 module_param_named(verbose, b43_modparam_verbose, int, 0644);
108 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
109
110 static int modparam_pio;
111 module_param_named(pio, modparam_pio, int, 0444);
112 MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
113
114 static const struct ssb_device_id b43_ssb_tbl[] = {
115         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
116         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
124         SSB_DEVTABLE_END
125 };
126
127 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
128
129 /* Channel and ratetables are shared for all devices.
130  * They can't be const, because ieee80211 puts some precalculated
131  * data in there. This data is the same for all devices, so we don't
132  * get concurrency issues */
133 #define RATETAB_ENT(_rateid, _flags) \
134         {                                                               \
135                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
136                 .hw_value       = (_rateid),                            \
137                 .flags          = (_flags),                             \
138         }
139
140 /*
141  * NOTE: When changing this, sync with xmit.c's
142  *       b43_plcp_get_bitrate_idx_* functions!
143  */
144 static struct ieee80211_rate __b43_ratetable[] = {
145         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
146         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
147         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
148         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
149         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
150         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
151         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
152         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
153         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
154         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
155         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
156         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
157 };
158
159 #define b43_a_ratetable         (__b43_ratetable + 4)
160 #define b43_a_ratetable_size    8
161 #define b43_b_ratetable         (__b43_ratetable + 0)
162 #define b43_b_ratetable_size    4
163 #define b43_g_ratetable         (__b43_ratetable + 0)
164 #define b43_g_ratetable_size    12
165
166 #define CHAN4G(_channel, _freq, _flags) {                       \
167         .band                   = IEEE80211_BAND_2GHZ,          \
168         .center_freq            = (_freq),                      \
169         .hw_value               = (_channel),                   \
170         .flags                  = (_flags),                     \
171         .max_antenna_gain       = 0,                            \
172         .max_power              = 30,                           \
173 }
174 static struct ieee80211_channel b43_2ghz_chantable[] = {
175         CHAN4G(1, 2412, 0),
176         CHAN4G(2, 2417, 0),
177         CHAN4G(3, 2422, 0),
178         CHAN4G(4, 2427, 0),
179         CHAN4G(5, 2432, 0),
180         CHAN4G(6, 2437, 0),
181         CHAN4G(7, 2442, 0),
182         CHAN4G(8, 2447, 0),
183         CHAN4G(9, 2452, 0),
184         CHAN4G(10, 2457, 0),
185         CHAN4G(11, 2462, 0),
186         CHAN4G(12, 2467, 0),
187         CHAN4G(13, 2472, 0),
188         CHAN4G(14, 2484, 0),
189 };
190 #undef CHAN4G
191
192 #define CHAN5G(_channel, _flags) {                              \
193         .band                   = IEEE80211_BAND_5GHZ,          \
194         .center_freq            = 5000 + (5 * (_channel)),      \
195         .hw_value               = (_channel),                   \
196         .flags                  = (_flags),                     \
197         .max_antenna_gain       = 0,                            \
198         .max_power              = 30,                           \
199 }
200 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
201         CHAN5G(32, 0),          CHAN5G(34, 0),
202         CHAN5G(36, 0),          CHAN5G(38, 0),
203         CHAN5G(40, 0),          CHAN5G(42, 0),
204         CHAN5G(44, 0),          CHAN5G(46, 0),
205         CHAN5G(48, 0),          CHAN5G(50, 0),
206         CHAN5G(52, 0),          CHAN5G(54, 0),
207         CHAN5G(56, 0),          CHAN5G(58, 0),
208         CHAN5G(60, 0),          CHAN5G(62, 0),
209         CHAN5G(64, 0),          CHAN5G(66, 0),
210         CHAN5G(68, 0),          CHAN5G(70, 0),
211         CHAN5G(72, 0),          CHAN5G(74, 0),
212         CHAN5G(76, 0),          CHAN5G(78, 0),
213         CHAN5G(80, 0),          CHAN5G(82, 0),
214         CHAN5G(84, 0),          CHAN5G(86, 0),
215         CHAN5G(88, 0),          CHAN5G(90, 0),
216         CHAN5G(92, 0),          CHAN5G(94, 0),
217         CHAN5G(96, 0),          CHAN5G(98, 0),
218         CHAN5G(100, 0),         CHAN5G(102, 0),
219         CHAN5G(104, 0),         CHAN5G(106, 0),
220         CHAN5G(108, 0),         CHAN5G(110, 0),
221         CHAN5G(112, 0),         CHAN5G(114, 0),
222         CHAN5G(116, 0),         CHAN5G(118, 0),
223         CHAN5G(120, 0),         CHAN5G(122, 0),
224         CHAN5G(124, 0),         CHAN5G(126, 0),
225         CHAN5G(128, 0),         CHAN5G(130, 0),
226         CHAN5G(132, 0),         CHAN5G(134, 0),
227         CHAN5G(136, 0),         CHAN5G(138, 0),
228         CHAN5G(140, 0),         CHAN5G(142, 0),
229         CHAN5G(144, 0),         CHAN5G(145, 0),
230         CHAN5G(146, 0),         CHAN5G(147, 0),
231         CHAN5G(148, 0),         CHAN5G(149, 0),
232         CHAN5G(150, 0),         CHAN5G(151, 0),
233         CHAN5G(152, 0),         CHAN5G(153, 0),
234         CHAN5G(154, 0),         CHAN5G(155, 0),
235         CHAN5G(156, 0),         CHAN5G(157, 0),
236         CHAN5G(158, 0),         CHAN5G(159, 0),
237         CHAN5G(160, 0),         CHAN5G(161, 0),
238         CHAN5G(162, 0),         CHAN5G(163, 0),
239         CHAN5G(164, 0),         CHAN5G(165, 0),
240         CHAN5G(166, 0),         CHAN5G(168, 0),
241         CHAN5G(170, 0),         CHAN5G(172, 0),
242         CHAN5G(174, 0),         CHAN5G(176, 0),
243         CHAN5G(178, 0),         CHAN5G(180, 0),
244         CHAN5G(182, 0),         CHAN5G(184, 0),
245         CHAN5G(186, 0),         CHAN5G(188, 0),
246         CHAN5G(190, 0),         CHAN5G(192, 0),
247         CHAN5G(194, 0),         CHAN5G(196, 0),
248         CHAN5G(198, 0),         CHAN5G(200, 0),
249         CHAN5G(202, 0),         CHAN5G(204, 0),
250         CHAN5G(206, 0),         CHAN5G(208, 0),
251         CHAN5G(210, 0),         CHAN5G(212, 0),
252         CHAN5G(214, 0),         CHAN5G(216, 0),
253         CHAN5G(218, 0),         CHAN5G(220, 0),
254         CHAN5G(222, 0),         CHAN5G(224, 0),
255         CHAN5G(226, 0),         CHAN5G(228, 0),
256 };
257
258 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
259         CHAN5G(34, 0),          CHAN5G(36, 0),
260         CHAN5G(38, 0),          CHAN5G(40, 0),
261         CHAN5G(42, 0),          CHAN5G(44, 0),
262         CHAN5G(46, 0),          CHAN5G(48, 0),
263         CHAN5G(52, 0),          CHAN5G(56, 0),
264         CHAN5G(60, 0),          CHAN5G(64, 0),
265         CHAN5G(100, 0),         CHAN5G(104, 0),
266         CHAN5G(108, 0),         CHAN5G(112, 0),
267         CHAN5G(116, 0),         CHAN5G(120, 0),
268         CHAN5G(124, 0),         CHAN5G(128, 0),
269         CHAN5G(132, 0),         CHAN5G(136, 0),
270         CHAN5G(140, 0),         CHAN5G(149, 0),
271         CHAN5G(153, 0),         CHAN5G(157, 0),
272         CHAN5G(161, 0),         CHAN5G(165, 0),
273         CHAN5G(184, 0),         CHAN5G(188, 0),
274         CHAN5G(192, 0),         CHAN5G(196, 0),
275         CHAN5G(200, 0),         CHAN5G(204, 0),
276         CHAN5G(208, 0),         CHAN5G(212, 0),
277         CHAN5G(216, 0),
278 };
279 #undef CHAN5G
280
281 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
282         .band           = IEEE80211_BAND_5GHZ,
283         .channels       = b43_5ghz_nphy_chantable,
284         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
285         .bitrates       = b43_a_ratetable,
286         .n_bitrates     = b43_a_ratetable_size,
287 };
288
289 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
290         .band           = IEEE80211_BAND_5GHZ,
291         .channels       = b43_5ghz_aphy_chantable,
292         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
293         .bitrates       = b43_a_ratetable,
294         .n_bitrates     = b43_a_ratetable_size,
295 };
296
297 static struct ieee80211_supported_band b43_band_2GHz = {
298         .band           = IEEE80211_BAND_2GHZ,
299         .channels       = b43_2ghz_chantable,
300         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
301         .bitrates       = b43_g_ratetable,
302         .n_bitrates     = b43_g_ratetable_size,
303 };
304
305 static void b43_wireless_core_exit(struct b43_wldev *dev);
306 static int b43_wireless_core_init(struct b43_wldev *dev);
307 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
308 static int b43_wireless_core_start(struct b43_wldev *dev);
309
310 static int b43_ratelimit(struct b43_wl *wl)
311 {
312         if (!wl || !wl->current_dev)
313                 return 1;
314         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
315                 return 1;
316         /* We are up and running.
317          * Ratelimit the messages to avoid DoS over the net. */
318         return net_ratelimit();
319 }
320
321 void b43info(struct b43_wl *wl, const char *fmt, ...)
322 {
323         va_list args;
324
325         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
326                 return;
327         if (!b43_ratelimit(wl))
328                 return;
329         va_start(args, fmt);
330         printk(KERN_INFO "b43-%s: ",
331                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332         vprintk(fmt, args);
333         va_end(args);
334 }
335
336 void b43err(struct b43_wl *wl, const char *fmt, ...)
337 {
338         va_list args;
339
340         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
341                 return;
342         if (!b43_ratelimit(wl))
343                 return;
344         va_start(args, fmt);
345         printk(KERN_ERR "b43-%s ERROR: ",
346                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
347         vprintk(fmt, args);
348         va_end(args);
349 }
350
351 void b43warn(struct b43_wl *wl, const char *fmt, ...)
352 {
353         va_list args;
354
355         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
356                 return;
357         if (!b43_ratelimit(wl))
358                 return;
359         va_start(args, fmt);
360         printk(KERN_WARNING "b43-%s warning: ",
361                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
362         vprintk(fmt, args);
363         va_end(args);
364 }
365
366 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
367 {
368         va_list args;
369
370         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
371                 return;
372         va_start(args, fmt);
373         printk(KERN_DEBUG "b43-%s debug: ",
374                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
375         vprintk(fmt, args);
376         va_end(args);
377 }
378
379 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
380 {
381         u32 macctl;
382
383         B43_WARN_ON(offset % 4 != 0);
384
385         macctl = b43_read32(dev, B43_MMIO_MACCTL);
386         if (macctl & B43_MACCTL_BE)
387                 val = swab32(val);
388
389         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
390         mmiowb();
391         b43_write32(dev, B43_MMIO_RAM_DATA, val);
392 }
393
394 static inline void b43_shm_control_word(struct b43_wldev *dev,
395                                         u16 routing, u16 offset)
396 {
397         u32 control;
398
399         /* "offset" is the WORD offset. */
400         control = routing;
401         control <<= 16;
402         control |= offset;
403         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
404 }
405
406 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
407 {
408         u32 ret;
409
410         if (routing == B43_SHM_SHARED) {
411                 B43_WARN_ON(offset & 0x0001);
412                 if (offset & 0x0003) {
413                         /* Unaligned access */
414                         b43_shm_control_word(dev, routing, offset >> 2);
415                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
416                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
417                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
418
419                         goto out;
420                 }
421                 offset >>= 2;
422         }
423         b43_shm_control_word(dev, routing, offset);
424         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
425 out:
426         return ret;
427 }
428
429 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
430 {
431         u16 ret;
432
433         if (routing == B43_SHM_SHARED) {
434                 B43_WARN_ON(offset & 0x0001);
435                 if (offset & 0x0003) {
436                         /* Unaligned access */
437                         b43_shm_control_word(dev, routing, offset >> 2);
438                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
439
440                         goto out;
441                 }
442                 offset >>= 2;
443         }
444         b43_shm_control_word(dev, routing, offset);
445         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
446 out:
447         return ret;
448 }
449
450 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
451 {
452         if (routing == B43_SHM_SHARED) {
453                 B43_WARN_ON(offset & 0x0001);
454                 if (offset & 0x0003) {
455                         /* Unaligned access */
456                         b43_shm_control_word(dev, routing, offset >> 2);
457                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
458                                     value & 0xFFFF);
459                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
460                         b43_write16(dev, B43_MMIO_SHM_DATA,
461                                     (value >> 16) & 0xFFFF);
462                         return;
463                 }
464                 offset >>= 2;
465         }
466         b43_shm_control_word(dev, routing, offset);
467         b43_write32(dev, B43_MMIO_SHM_DATA, value);
468 }
469
470 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
471 {
472         if (routing == B43_SHM_SHARED) {
473                 B43_WARN_ON(offset & 0x0001);
474                 if (offset & 0x0003) {
475                         /* Unaligned access */
476                         b43_shm_control_word(dev, routing, offset >> 2);
477                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
478                         return;
479                 }
480                 offset >>= 2;
481         }
482         b43_shm_control_word(dev, routing, offset);
483         b43_write16(dev, B43_MMIO_SHM_DATA, value);
484 }
485
486 /* Read HostFlags */
487 u64 b43_hf_read(struct b43_wldev *dev)
488 {
489         u64 ret;
490
491         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
492         ret <<= 16;
493         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
494         ret <<= 16;
495         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
496
497         return ret;
498 }
499
500 /* Write HostFlags */
501 void b43_hf_write(struct b43_wldev *dev, u64 value)
502 {
503         u16 lo, mi, hi;
504
505         lo = (value & 0x00000000FFFFULL);
506         mi = (value & 0x0000FFFF0000ULL) >> 16;
507         hi = (value & 0xFFFF00000000ULL) >> 32;
508         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
509         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
510         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
511 }
512
513 /* Read the firmware capabilities bitmask (Opensource firmware only) */
514 static u16 b43_fwcapa_read(struct b43_wldev *dev)
515 {
516         B43_WARN_ON(!dev->fw.opensource);
517         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
518 }
519
520 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
521 {
522         u32 low, high;
523
524         B43_WARN_ON(dev->dev->id.revision < 3);
525
526         /* The hardware guarantees us an atomic read, if we
527          * read the low register first. */
528         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
529         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
530
531         *tsf = high;
532         *tsf <<= 32;
533         *tsf |= low;
534 }
535
536 static void b43_time_lock(struct b43_wldev *dev)
537 {
538         u32 macctl;
539
540         macctl = b43_read32(dev, B43_MMIO_MACCTL);
541         macctl |= B43_MACCTL_TBTTHOLD;
542         b43_write32(dev, B43_MMIO_MACCTL, macctl);
543         /* Commit the write */
544         b43_read32(dev, B43_MMIO_MACCTL);
545 }
546
547 static void b43_time_unlock(struct b43_wldev *dev)
548 {
549         u32 macctl;
550
551         macctl = b43_read32(dev, B43_MMIO_MACCTL);
552         macctl &= ~B43_MACCTL_TBTTHOLD;
553         b43_write32(dev, B43_MMIO_MACCTL, macctl);
554         /* Commit the write */
555         b43_read32(dev, B43_MMIO_MACCTL);
556 }
557
558 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
559 {
560         u32 low, high;
561
562         B43_WARN_ON(dev->dev->id.revision < 3);
563
564         low = tsf;
565         high = (tsf >> 32);
566         /* The hardware guarantees us an atomic write, if we
567          * write the low register first. */
568         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
569         mmiowb();
570         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
571         mmiowb();
572 }
573
574 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
575 {
576         b43_time_lock(dev);
577         b43_tsf_write_locked(dev, tsf);
578         b43_time_unlock(dev);
579 }
580
581 static
582 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
583 {
584         static const u8 zero_addr[ETH_ALEN] = { 0 };
585         u16 data;
586
587         if (!mac)
588                 mac = zero_addr;
589
590         offset |= 0x0020;
591         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
592
593         data = mac[0];
594         data |= mac[1] << 8;
595         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
596         data = mac[2];
597         data |= mac[3] << 8;
598         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
599         data = mac[4];
600         data |= mac[5] << 8;
601         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
602 }
603
604 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
605 {
606         const u8 *mac;
607         const u8 *bssid;
608         u8 mac_bssid[ETH_ALEN * 2];
609         int i;
610         u32 tmp;
611
612         bssid = dev->wl->bssid;
613         mac = dev->wl->mac_addr;
614
615         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
616
617         memcpy(mac_bssid, mac, ETH_ALEN);
618         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
619
620         /* Write our MAC address and BSSID to template ram */
621         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
622                 tmp = (u32) (mac_bssid[i + 0]);
623                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
624                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
625                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
626                 b43_ram_write(dev, 0x20 + i, tmp);
627         }
628 }
629
630 static void b43_upload_card_macaddress(struct b43_wldev *dev)
631 {
632         b43_write_mac_bssid_templates(dev);
633         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
634 }
635
636 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
637 {
638         /* slot_time is in usec. */
639         if (dev->phy.type != B43_PHYTYPE_G)
640                 return;
641         b43_write16(dev, 0x684, 510 + slot_time);
642         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
643 }
644
645 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
646 {
647         b43_set_slot_time(dev, 9);
648 }
649
650 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
651 {
652         b43_set_slot_time(dev, 20);
653 }
654
655 /* DummyTransmission function, as documented on
656  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
657  */
658 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
659 {
660         struct b43_phy *phy = &dev->phy;
661         unsigned int i, max_loop;
662         u16 value;
663         u32 buffer[5] = {
664                 0x00000000,
665                 0x00D40000,
666                 0x00000000,
667                 0x01000000,
668                 0x00000000,
669         };
670
671         if (ofdm) {
672                 max_loop = 0x1E;
673                 buffer[0] = 0x000201CC;
674         } else {
675                 max_loop = 0xFA;
676                 buffer[0] = 0x000B846E;
677         }
678
679         for (i = 0; i < 5; i++)
680                 b43_ram_write(dev, i * 4, buffer[i]);
681
682         b43_write16(dev, 0x0568, 0x0000);
683         if (dev->dev->id.revision < 11)
684                 b43_write16(dev, 0x07C0, 0x0000);
685         else
686                 b43_write16(dev, 0x07C0, 0x0100);
687         value = (ofdm ? 0x41 : 0x40);
688         b43_write16(dev, 0x050C, value);
689         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
690                 b43_write16(dev, 0x0514, 0x1A02);
691         b43_write16(dev, 0x0508, 0x0000);
692         b43_write16(dev, 0x050A, 0x0000);
693         b43_write16(dev, 0x054C, 0x0000);
694         b43_write16(dev, 0x056A, 0x0014);
695         b43_write16(dev, 0x0568, 0x0826);
696         b43_write16(dev, 0x0500, 0x0000);
697         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
698                 //SPEC TODO
699         }
700
701         switch (phy->type) {
702         case B43_PHYTYPE_N:
703                 b43_write16(dev, 0x0502, 0x00D0);
704                 break;
705         case B43_PHYTYPE_LP:
706                 b43_write16(dev, 0x0502, 0x0050);
707                 break;
708         default:
709                 b43_write16(dev, 0x0502, 0x0030);
710         }
711
712         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
713                 b43_radio_write16(dev, 0x0051, 0x0017);
714         for (i = 0x00; i < max_loop; i++) {
715                 value = b43_read16(dev, 0x050E);
716                 if (value & 0x0080)
717                         break;
718                 udelay(10);
719         }
720         for (i = 0x00; i < 0x0A; i++) {
721                 value = b43_read16(dev, 0x050E);
722                 if (value & 0x0400)
723                         break;
724                 udelay(10);
725         }
726         for (i = 0x00; i < 0x19; i++) {
727                 value = b43_read16(dev, 0x0690);
728                 if (!(value & 0x0100))
729                         break;
730                 udelay(10);
731         }
732         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
733                 b43_radio_write16(dev, 0x0051, 0x0037);
734 }
735
736 static void key_write(struct b43_wldev *dev,
737                       u8 index, u8 algorithm, const u8 *key)
738 {
739         unsigned int i;
740         u32 offset;
741         u16 value;
742         u16 kidx;
743
744         /* Key index/algo block */
745         kidx = b43_kidx_to_fw(dev, index);
746         value = ((kidx << 4) | algorithm);
747         b43_shm_write16(dev, B43_SHM_SHARED,
748                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
749
750         /* Write the key to the Key Table Pointer offset */
751         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
752         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
753                 value = key[i];
754                 value |= (u16) (key[i + 1]) << 8;
755                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
756         }
757 }
758
759 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
760 {
761         u32 addrtmp[2] = { 0, 0, };
762         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
763
764         if (b43_new_kidx_api(dev))
765                 pairwise_keys_start = B43_NR_GROUP_KEYS;
766
767         B43_WARN_ON(index < pairwise_keys_start);
768         /* We have four default TX keys and possibly four default RX keys.
769          * Physical mac 0 is mapped to physical key 4 or 8, depending
770          * on the firmware version.
771          * So we must adjust the index here.
772          */
773         index -= pairwise_keys_start;
774         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
775
776         if (addr) {
777                 addrtmp[0] = addr[0];
778                 addrtmp[0] |= ((u32) (addr[1]) << 8);
779                 addrtmp[0] |= ((u32) (addr[2]) << 16);
780                 addrtmp[0] |= ((u32) (addr[3]) << 24);
781                 addrtmp[1] = addr[4];
782                 addrtmp[1] |= ((u32) (addr[5]) << 8);
783         }
784
785         /* Receive match transmitter address (RCMTA) mechanism */
786         b43_shm_write32(dev, B43_SHM_RCMTA,
787                         (index * 2) + 0, addrtmp[0]);
788         b43_shm_write16(dev, B43_SHM_RCMTA,
789                         (index * 2) + 1, addrtmp[1]);
790 }
791
792 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
793  * When a packet is received, the iv32 is checked.
794  * - if it doesn't the packet is returned without modification (and software
795  *   decryption can be done). That's what happen when iv16 wrap.
796  * - if it does, the rc4 key is computed, and decryption is tried.
797  *   Either it will success and B43_RX_MAC_DEC is returned,
798  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
799  *   and the packet is not usable (it got modified by the ucode).
800  * So in order to never have B43_RX_MAC_DECERR, we should provide
801  * a iv32 and phase1key that match. Because we drop packets in case of
802  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
803  * packets will be lost without higher layer knowing (ie no resync possible
804  * until next wrap).
805  *
806  * NOTE : this should support 50 key like RCMTA because
807  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
808  */
809 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
810                 u16 *phase1key)
811 {
812         unsigned int i;
813         u32 offset;
814         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
815
816         if (!modparam_hwtkip)
817                 return;
818
819         if (b43_new_kidx_api(dev))
820                 pairwise_keys_start = B43_NR_GROUP_KEYS;
821
822         B43_WARN_ON(index < pairwise_keys_start);
823         /* We have four default TX keys and possibly four default RX keys.
824          * Physical mac 0 is mapped to physical key 4 or 8, depending
825          * on the firmware version.
826          * So we must adjust the index here.
827          */
828         index -= pairwise_keys_start;
829         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
830
831         if (b43_debug(dev, B43_DBG_KEYS)) {
832                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
833                                 index, iv32);
834         }
835         /* Write the key to the  RX tkip shared mem */
836         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
837         for (i = 0; i < 10; i += 2) {
838                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
839                                 phase1key ? phase1key[i / 2] : 0);
840         }
841         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
842         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
843 }
844
845 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
846                         struct ieee80211_key_conf *keyconf, const u8 *addr,
847                         u32 iv32, u16 *phase1key)
848 {
849         struct b43_wl *wl = hw_to_b43_wl(hw);
850         struct b43_wldev *dev;
851         int index = keyconf->hw_key_idx;
852
853         if (B43_WARN_ON(!modparam_hwtkip))
854                 return;
855
856         mutex_lock(&wl->mutex);
857
858         dev = wl->current_dev;
859         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
860                 goto out_unlock;
861
862         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
863
864         rx_tkip_phase1_write(dev, index, iv32, phase1key);
865         keymac_write(dev, index, addr);
866
867 out_unlock:
868         mutex_unlock(&wl->mutex);
869 }
870
871 static void do_key_write(struct b43_wldev *dev,
872                          u8 index, u8 algorithm,
873                          const u8 *key, size_t key_len, const u8 *mac_addr)
874 {
875         u8 buf[B43_SEC_KEYSIZE] = { 0, };
876         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
877
878         if (b43_new_kidx_api(dev))
879                 pairwise_keys_start = B43_NR_GROUP_KEYS;
880
881         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
882         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
883
884         if (index >= pairwise_keys_start)
885                 keymac_write(dev, index, NULL); /* First zero out mac. */
886         if (algorithm == B43_SEC_ALGO_TKIP) {
887                 /*
888                  * We should provide an initial iv32, phase1key pair.
889                  * We could start with iv32=0 and compute the corresponding
890                  * phase1key, but this means calling ieee80211_get_tkip_key
891                  * with a fake skb (or export other tkip function).
892                  * Because we are lazy we hope iv32 won't start with
893                  * 0xffffffff and let's b43_op_update_tkip_key provide a
894                  * correct pair.
895                  */
896                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
897         } else if (index >= pairwise_keys_start) /* clear it */
898                 rx_tkip_phase1_write(dev, index, 0, NULL);
899         if (key)
900                 memcpy(buf, key, key_len);
901         key_write(dev, index, algorithm, buf);
902         if (index >= pairwise_keys_start)
903                 keymac_write(dev, index, mac_addr);
904
905         dev->key[index].algorithm = algorithm;
906 }
907
908 static int b43_key_write(struct b43_wldev *dev,
909                          int index, u8 algorithm,
910                          const u8 *key, size_t key_len,
911                          const u8 *mac_addr,
912                          struct ieee80211_key_conf *keyconf)
913 {
914         int i;
915         int pairwise_keys_start;
916
917         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
918          *      - Temporal Encryption Key (128 bits)
919          *      - Temporal Authenticator Tx MIC Key (64 bits)
920          *      - Temporal Authenticator Rx MIC Key (64 bits)
921          *
922          *      Hardware only store TEK
923          */
924         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
925                 key_len = 16;
926         if (key_len > B43_SEC_KEYSIZE)
927                 return -EINVAL;
928         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
929                 /* Check that we don't already have this key. */
930                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
931         }
932         if (index < 0) {
933                 /* Pairwise key. Get an empty slot for the key. */
934                 if (b43_new_kidx_api(dev))
935                         pairwise_keys_start = B43_NR_GROUP_KEYS;
936                 else
937                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
938                 for (i = pairwise_keys_start;
939                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
940                      i++) {
941                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
942                         if (!dev->key[i].keyconf) {
943                                 /* found empty */
944                                 index = i;
945                                 break;
946                         }
947                 }
948                 if (index < 0) {
949                         b43warn(dev->wl, "Out of hardware key memory\n");
950                         return -ENOSPC;
951                 }
952         } else
953                 B43_WARN_ON(index > 3);
954
955         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
956         if ((index <= 3) && !b43_new_kidx_api(dev)) {
957                 /* Default RX key */
958                 B43_WARN_ON(mac_addr);
959                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
960         }
961         keyconf->hw_key_idx = index;
962         dev->key[index].keyconf = keyconf;
963
964         return 0;
965 }
966
967 static int b43_key_clear(struct b43_wldev *dev, int index)
968 {
969         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
970                 return -EINVAL;
971         do_key_write(dev, index, B43_SEC_ALGO_NONE,
972                      NULL, B43_SEC_KEYSIZE, NULL);
973         if ((index <= 3) && !b43_new_kidx_api(dev)) {
974                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
975                              NULL, B43_SEC_KEYSIZE, NULL);
976         }
977         dev->key[index].keyconf = NULL;
978
979         return 0;
980 }
981
982 static void b43_clear_keys(struct b43_wldev *dev)
983 {
984         int i, count;
985
986         if (b43_new_kidx_api(dev))
987                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
988         else
989                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
990         for (i = 0; i < count; i++)
991                 b43_key_clear(dev, i);
992 }
993
994 static void b43_dump_keymemory(struct b43_wldev *dev)
995 {
996         unsigned int i, index, count, offset, pairwise_keys_start;
997         u8 mac[ETH_ALEN];
998         u16 algo;
999         u32 rcmta0;
1000         u16 rcmta1;
1001         u64 hf;
1002         struct b43_key *key;
1003
1004         if (!b43_debug(dev, B43_DBG_KEYS))
1005                 return;
1006
1007         hf = b43_hf_read(dev);
1008         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1009                !!(hf & B43_HF_USEDEFKEYS));
1010         if (b43_new_kidx_api(dev)) {
1011                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1012                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1013         } else {
1014                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1015                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1016         }
1017         for (index = 0; index < count; index++) {
1018                 key = &(dev->key[index]);
1019                 printk(KERN_DEBUG "Key slot %02u: %s",
1020                        index, (key->keyconf == NULL) ? " " : "*");
1021                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1022                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1023                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1024                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1025                 }
1026
1027                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1028                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1029                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1030
1031                 if (index >= pairwise_keys_start) {
1032                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1033                                 printk("   TKIP: ");
1034                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1035                                 for (i = 0; i < 14; i += 2) {
1036                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1037                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1038                                 }
1039                         }
1040                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1041                                                 ((index - pairwise_keys_start) * 2) + 0);
1042                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1043                                                 ((index - pairwise_keys_start) * 2) + 1);
1044                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1045                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1046                         printk("   MAC: %pM", mac);
1047                 } else
1048                         printk("   DEFAULT KEY");
1049                 printk("\n");
1050         }
1051 }
1052
1053 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1054 {
1055         u32 macctl;
1056         u16 ucstat;
1057         bool hwps;
1058         bool awake;
1059         int i;
1060
1061         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1062                     (ps_flags & B43_PS_DISABLED));
1063         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1064
1065         if (ps_flags & B43_PS_ENABLED) {
1066                 hwps = 1;
1067         } else if (ps_flags & B43_PS_DISABLED) {
1068                 hwps = 0;
1069         } else {
1070                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1071                 //      and thus is not an AP and we are associated, set bit 25
1072         }
1073         if (ps_flags & B43_PS_AWAKE) {
1074                 awake = 1;
1075         } else if (ps_flags & B43_PS_ASLEEP) {
1076                 awake = 0;
1077         } else {
1078                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1079                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1080                 //      successful, set bit26
1081         }
1082
1083 /* FIXME: For now we force awake-on and hwps-off */
1084         hwps = 0;
1085         awake = 1;
1086
1087         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1088         if (hwps)
1089                 macctl |= B43_MACCTL_HWPS;
1090         else
1091                 macctl &= ~B43_MACCTL_HWPS;
1092         if (awake)
1093                 macctl |= B43_MACCTL_AWAKE;
1094         else
1095                 macctl &= ~B43_MACCTL_AWAKE;
1096         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1097         /* Commit write */
1098         b43_read32(dev, B43_MMIO_MACCTL);
1099         if (awake && dev->dev->id.revision >= 5) {
1100                 /* Wait for the microcode to wake up. */
1101                 for (i = 0; i < 100; i++) {
1102                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1103                                                 B43_SHM_SH_UCODESTAT);
1104                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1105                                 break;
1106                         udelay(10);
1107                 }
1108         }
1109 }
1110
1111 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1112 {
1113         u32 tmslow;
1114         u32 macctl;
1115
1116         flags |= B43_TMSLOW_PHYCLKEN;
1117         flags |= B43_TMSLOW_PHYRESET;
1118         ssb_device_enable(dev->dev, flags);
1119         msleep(2);              /* Wait for the PLL to turn on. */
1120
1121         /* Now take the PHY out of Reset again */
1122         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1123         tmslow |= SSB_TMSLOW_FGC;
1124         tmslow &= ~B43_TMSLOW_PHYRESET;
1125         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1126         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1127         msleep(1);
1128         tmslow &= ~SSB_TMSLOW_FGC;
1129         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1130         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1131         msleep(1);
1132
1133         /* Turn Analog ON, but only if we already know the PHY-type.
1134          * This protects against very early setup where we don't know the
1135          * PHY-type, yet. wireless_core_reset will be called once again later,
1136          * when we know the PHY-type. */
1137         if (dev->phy.ops)
1138                 dev->phy.ops->switch_analog(dev, 1);
1139
1140         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1141         macctl &= ~B43_MACCTL_GMODE;
1142         if (flags & B43_TMSLOW_GMODE)
1143                 macctl |= B43_MACCTL_GMODE;
1144         macctl |= B43_MACCTL_IHR_ENABLED;
1145         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1146 }
1147
1148 static void handle_irq_transmit_status(struct b43_wldev *dev)
1149 {
1150         u32 v0, v1;
1151         u16 tmp;
1152         struct b43_txstatus stat;
1153
1154         while (1) {
1155                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1156                 if (!(v0 & 0x00000001))
1157                         break;
1158                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1159
1160                 stat.cookie = (v0 >> 16);
1161                 stat.seq = (v1 & 0x0000FFFF);
1162                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1163                 tmp = (v0 & 0x0000FFFF);
1164                 stat.frame_count = ((tmp & 0xF000) >> 12);
1165                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1166                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1167                 stat.pm_indicated = !!(tmp & 0x0080);
1168                 stat.intermediate = !!(tmp & 0x0040);
1169                 stat.for_ampdu = !!(tmp & 0x0020);
1170                 stat.acked = !!(tmp & 0x0002);
1171
1172                 b43_handle_txstatus(dev, &stat);
1173         }
1174 }
1175
1176 static void drain_txstatus_queue(struct b43_wldev *dev)
1177 {
1178         u32 dummy;
1179
1180         if (dev->dev->id.revision < 5)
1181                 return;
1182         /* Read all entries from the microcode TXstatus FIFO
1183          * and throw them away.
1184          */
1185         while (1) {
1186                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1187                 if (!(dummy & 0x00000001))
1188                         break;
1189                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1190         }
1191 }
1192
1193 static u32 b43_jssi_read(struct b43_wldev *dev)
1194 {
1195         u32 val = 0;
1196
1197         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1198         val <<= 16;
1199         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1200
1201         return val;
1202 }
1203
1204 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1205 {
1206         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1207         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1208 }
1209
1210 static void b43_generate_noise_sample(struct b43_wldev *dev)
1211 {
1212         b43_jssi_write(dev, 0x7F7F7F7F);
1213         b43_write32(dev, B43_MMIO_MACCMD,
1214                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1215 }
1216
1217 static void b43_calculate_link_quality(struct b43_wldev *dev)
1218 {
1219         /* Top half of Link Quality calculation. */
1220
1221         if (dev->phy.type != B43_PHYTYPE_G)
1222                 return;
1223         if (dev->noisecalc.calculation_running)
1224                 return;
1225         dev->noisecalc.calculation_running = 1;
1226         dev->noisecalc.nr_samples = 0;
1227
1228         b43_generate_noise_sample(dev);
1229 }
1230
1231 static void handle_irq_noise(struct b43_wldev *dev)
1232 {
1233         struct b43_phy_g *phy = dev->phy.g;
1234         u16 tmp;
1235         u8 noise[4];
1236         u8 i, j;
1237         s32 average;
1238
1239         /* Bottom half of Link Quality calculation. */
1240
1241         if (dev->phy.type != B43_PHYTYPE_G)
1242                 return;
1243
1244         /* Possible race condition: It might be possible that the user
1245          * changed to a different channel in the meantime since we
1246          * started the calculation. We ignore that fact, since it's
1247          * not really that much of a problem. The background noise is
1248          * an estimation only anyway. Slightly wrong results will get damped
1249          * by the averaging of the 8 sample rounds. Additionally the
1250          * value is shortlived. So it will be replaced by the next noise
1251          * calculation round soon. */
1252
1253         B43_WARN_ON(!dev->noisecalc.calculation_running);
1254         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1255         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1256             noise[2] == 0x7F || noise[3] == 0x7F)
1257                 goto generate_new;
1258
1259         /* Get the noise samples. */
1260         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1261         i = dev->noisecalc.nr_samples;
1262         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1263         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1264         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1265         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1266         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1267         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1268         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1269         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1270         dev->noisecalc.nr_samples++;
1271         if (dev->noisecalc.nr_samples == 8) {
1272                 /* Calculate the Link Quality by the noise samples. */
1273                 average = 0;
1274                 for (i = 0; i < 8; i++) {
1275                         for (j = 0; j < 4; j++)
1276                                 average += dev->noisecalc.samples[i][j];
1277                 }
1278                 average /= (8 * 4);
1279                 average *= 125;
1280                 average += 64;
1281                 average /= 128;
1282                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1283                 tmp = (tmp / 128) & 0x1F;
1284                 if (tmp >= 8)
1285                         average += 2;
1286                 else
1287                         average -= 25;
1288                 if (tmp == 8)
1289                         average -= 72;
1290                 else
1291                         average -= 48;
1292
1293                 dev->stats.link_noise = average;
1294                 dev->noisecalc.calculation_running = 0;
1295                 return;
1296         }
1297 generate_new:
1298         b43_generate_noise_sample(dev);
1299 }
1300
1301 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1302 {
1303         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1304                 ///TODO: PS TBTT
1305         } else {
1306                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1307                         b43_power_saving_ctl_bits(dev, 0);
1308         }
1309         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1310                 dev->dfq_valid = 1;
1311 }
1312
1313 static void handle_irq_atim_end(struct b43_wldev *dev)
1314 {
1315         if (dev->dfq_valid) {
1316                 b43_write32(dev, B43_MMIO_MACCMD,
1317                             b43_read32(dev, B43_MMIO_MACCMD)
1318                             | B43_MACCMD_DFQ_VALID);
1319                 dev->dfq_valid = 0;
1320         }
1321 }
1322
1323 static void handle_irq_pmq(struct b43_wldev *dev)
1324 {
1325         u32 tmp;
1326
1327         //TODO: AP mode.
1328
1329         while (1) {
1330                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1331                 if (!(tmp & 0x00000008))
1332                         break;
1333         }
1334         /* 16bit write is odd, but correct. */
1335         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1336 }
1337
1338 static void b43_write_template_common(struct b43_wldev *dev,
1339                                       const u8 *data, u16 size,
1340                                       u16 ram_offset,
1341                                       u16 shm_size_offset, u8 rate)
1342 {
1343         u32 i, tmp;
1344         struct b43_plcp_hdr4 plcp;
1345
1346         plcp.data = 0;
1347         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1348         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1349         ram_offset += sizeof(u32);
1350         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1351          * So leave the first two bytes of the next write blank.
1352          */
1353         tmp = (u32) (data[0]) << 16;
1354         tmp |= (u32) (data[1]) << 24;
1355         b43_ram_write(dev, ram_offset, tmp);
1356         ram_offset += sizeof(u32);
1357         for (i = 2; i < size; i += sizeof(u32)) {
1358                 tmp = (u32) (data[i + 0]);
1359                 if (i + 1 < size)
1360                         tmp |= (u32) (data[i + 1]) << 8;
1361                 if (i + 2 < size)
1362                         tmp |= (u32) (data[i + 2]) << 16;
1363                 if (i + 3 < size)
1364                         tmp |= (u32) (data[i + 3]) << 24;
1365                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1366         }
1367         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1368                         size + sizeof(struct b43_plcp_hdr6));
1369 }
1370
1371 /* Check if the use of the antenna that ieee80211 told us to
1372  * use is possible. This will fall back to DEFAULT.
1373  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1374 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1375                                   u8 antenna_nr)
1376 {
1377         u8 antenna_mask;
1378
1379         if (antenna_nr == 0) {
1380                 /* Zero means "use default antenna". That's always OK. */
1381                 return 0;
1382         }
1383
1384         /* Get the mask of available antennas. */
1385         if (dev->phy.gmode)
1386                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1387         else
1388                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1389
1390         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1391                 /* This antenna is not available. Fall back to default. */
1392                 return 0;
1393         }
1394
1395         return antenna_nr;
1396 }
1397
1398 /* Convert a b43 antenna number value to the PHY TX control value. */
1399 static u16 b43_antenna_to_phyctl(int antenna)
1400 {
1401         switch (antenna) {
1402         case B43_ANTENNA0:
1403                 return B43_TXH_PHY_ANT0;
1404         case B43_ANTENNA1:
1405                 return B43_TXH_PHY_ANT1;
1406         case B43_ANTENNA2:
1407                 return B43_TXH_PHY_ANT2;
1408         case B43_ANTENNA3:
1409                 return B43_TXH_PHY_ANT3;
1410         case B43_ANTENNA_AUTO0:
1411         case B43_ANTENNA_AUTO1:
1412                 return B43_TXH_PHY_ANT01AUTO;
1413         }
1414         B43_WARN_ON(1);
1415         return 0;
1416 }
1417
1418 static void b43_write_beacon_template(struct b43_wldev *dev,
1419                                       u16 ram_offset,
1420                                       u16 shm_size_offset)
1421 {
1422         unsigned int i, len, variable_len;
1423         const struct ieee80211_mgmt *bcn;
1424         const u8 *ie;
1425         bool tim_found = 0;
1426         unsigned int rate;
1427         u16 ctl;
1428         int antenna;
1429         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1430
1431         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1432         len = min((size_t) dev->wl->current_beacon->len,
1433                   0x200 - sizeof(struct b43_plcp_hdr6));
1434         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1435
1436         b43_write_template_common(dev, (const u8 *)bcn,
1437                                   len, ram_offset, shm_size_offset, rate);
1438
1439         /* Write the PHY TX control parameters. */
1440         antenna = B43_ANTENNA_DEFAULT;
1441         antenna = b43_antenna_to_phyctl(antenna);
1442         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1443         /* We can't send beacons with short preamble. Would get PHY errors. */
1444         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1445         ctl &= ~B43_TXH_PHY_ANT;
1446         ctl &= ~B43_TXH_PHY_ENC;
1447         ctl |= antenna;
1448         if (b43_is_cck_rate(rate))
1449                 ctl |= B43_TXH_PHY_ENC_CCK;
1450         else
1451                 ctl |= B43_TXH_PHY_ENC_OFDM;
1452         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1453
1454         /* Find the position of the TIM and the DTIM_period value
1455          * and write them to SHM. */
1456         ie = bcn->u.beacon.variable;
1457         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1458         for (i = 0; i < variable_len - 2; ) {
1459                 uint8_t ie_id, ie_len;
1460
1461                 ie_id = ie[i];
1462                 ie_len = ie[i + 1];
1463                 if (ie_id == 5) {
1464                         u16 tim_position;
1465                         u16 dtim_period;
1466                         /* This is the TIM Information Element */
1467
1468                         /* Check whether the ie_len is in the beacon data range. */
1469                         if (variable_len < ie_len + 2 + i)
1470                                 break;
1471                         /* A valid TIM is at least 4 bytes long. */
1472                         if (ie_len < 4)
1473                                 break;
1474                         tim_found = 1;
1475
1476                         tim_position = sizeof(struct b43_plcp_hdr6);
1477                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1478                         tim_position += i;
1479
1480                         dtim_period = ie[i + 3];
1481
1482                         b43_shm_write16(dev, B43_SHM_SHARED,
1483                                         B43_SHM_SH_TIMBPOS, tim_position);
1484                         b43_shm_write16(dev, B43_SHM_SHARED,
1485                                         B43_SHM_SH_DTIMPER, dtim_period);
1486                         break;
1487                 }
1488                 i += ie_len + 2;
1489         }
1490         if (!tim_found) {
1491                 /*
1492                  * If ucode wants to modify TIM do it behind the beacon, this
1493                  * will happen, for example, when doing mesh networking.
1494                  */
1495                 b43_shm_write16(dev, B43_SHM_SHARED,
1496                                 B43_SHM_SH_TIMBPOS,
1497                                 len + sizeof(struct b43_plcp_hdr6));
1498                 b43_shm_write16(dev, B43_SHM_SHARED,
1499                                 B43_SHM_SH_DTIMPER, 0);
1500         }
1501         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1502 }
1503
1504 static void b43_upload_beacon0(struct b43_wldev *dev)
1505 {
1506         struct b43_wl *wl = dev->wl;
1507
1508         if (wl->beacon0_uploaded)
1509                 return;
1510         b43_write_beacon_template(dev, 0x68, 0x18);
1511         wl->beacon0_uploaded = 1;
1512 }
1513
1514 static void b43_upload_beacon1(struct b43_wldev *dev)
1515 {
1516         struct b43_wl *wl = dev->wl;
1517
1518         if (wl->beacon1_uploaded)
1519                 return;
1520         b43_write_beacon_template(dev, 0x468, 0x1A);
1521         wl->beacon1_uploaded = 1;
1522 }
1523
1524 static void handle_irq_beacon(struct b43_wldev *dev)
1525 {
1526         struct b43_wl *wl = dev->wl;
1527         u32 cmd, beacon0_valid, beacon1_valid;
1528
1529         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1530             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1531                 return;
1532
1533         /* This is the bottom half of the asynchronous beacon update. */
1534
1535         /* Ignore interrupt in the future. */
1536         dev->irq_mask &= ~B43_IRQ_BEACON;
1537
1538         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1539         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1540         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1541
1542         /* Schedule interrupt manually, if busy. */
1543         if (beacon0_valid && beacon1_valid) {
1544                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1545                 dev->irq_mask |= B43_IRQ_BEACON;
1546                 return;
1547         }
1548
1549         if (unlikely(wl->beacon_templates_virgin)) {
1550                 /* We never uploaded a beacon before.
1551                  * Upload both templates now, but only mark one valid. */
1552                 wl->beacon_templates_virgin = 0;
1553                 b43_upload_beacon0(dev);
1554                 b43_upload_beacon1(dev);
1555                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1556                 cmd |= B43_MACCMD_BEACON0_VALID;
1557                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1558         } else {
1559                 if (!beacon0_valid) {
1560                         b43_upload_beacon0(dev);
1561                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1562                         cmd |= B43_MACCMD_BEACON0_VALID;
1563                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1564                 } else if (!beacon1_valid) {
1565                         b43_upload_beacon1(dev);
1566                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1567                         cmd |= B43_MACCMD_BEACON1_VALID;
1568                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1569                 }
1570         }
1571 }
1572
1573 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1574 {
1575         u32 old_irq_mask = dev->irq_mask;
1576
1577         /* update beacon right away or defer to irq */
1578         handle_irq_beacon(dev);
1579         if (old_irq_mask != dev->irq_mask) {
1580                 /* The handler updated the IRQ mask. */
1581                 B43_WARN_ON(!dev->irq_mask);
1582                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1583                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1584                 } else {
1585                         /* Device interrupts are currently disabled. That means
1586                          * we just ran the hardirq handler and scheduled the
1587                          * IRQ thread. The thread will write the IRQ mask when
1588                          * it finished, so there's nothing to do here. Writing
1589                          * the mask _here_ would incorrectly re-enable IRQs. */
1590                 }
1591         }
1592 }
1593
1594 static void b43_beacon_update_trigger_work(struct work_struct *work)
1595 {
1596         struct b43_wl *wl = container_of(work, struct b43_wl,
1597                                          beacon_update_trigger);
1598         struct b43_wldev *dev;
1599
1600         mutex_lock(&wl->mutex);
1601         dev = wl->current_dev;
1602         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1603                 if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
1604                         /* wl->mutex is enough. */
1605                         b43_do_beacon_update_trigger_work(dev);
1606                         mmiowb();
1607                 } else {
1608                         spin_lock_irq(&wl->hardirq_lock);
1609                         b43_do_beacon_update_trigger_work(dev);
1610                         mmiowb();
1611                         spin_unlock_irq(&wl->hardirq_lock);
1612                 }
1613         }
1614         mutex_unlock(&wl->mutex);
1615 }
1616
1617 /* Asynchronously update the packet templates in template RAM.
1618  * Locking: Requires wl->mutex to be locked. */
1619 static void b43_update_templates(struct b43_wl *wl)
1620 {
1621         struct sk_buff *beacon;
1622
1623         /* This is the top half of the ansynchronous beacon update.
1624          * The bottom half is the beacon IRQ.
1625          * Beacon update must be asynchronous to avoid sending an
1626          * invalid beacon. This can happen for example, if the firmware
1627          * transmits a beacon while we are updating it. */
1628
1629         /* We could modify the existing beacon and set the aid bit in
1630          * the TIM field, but that would probably require resizing and
1631          * moving of data within the beacon template.
1632          * Simply request a new beacon and let mac80211 do the hard work. */
1633         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1634         if (unlikely(!beacon))
1635                 return;
1636
1637         if (wl->current_beacon)
1638                 dev_kfree_skb_any(wl->current_beacon);
1639         wl->current_beacon = beacon;
1640         wl->beacon0_uploaded = 0;
1641         wl->beacon1_uploaded = 0;
1642         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1643 }
1644
1645 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1646 {
1647         b43_time_lock(dev);
1648         if (dev->dev->id.revision >= 3) {
1649                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1650                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1651         } else {
1652                 b43_write16(dev, 0x606, (beacon_int >> 6));
1653                 b43_write16(dev, 0x610, beacon_int);
1654         }
1655         b43_time_unlock(dev);
1656         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1657 }
1658
1659 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1660 {
1661         u16 reason;
1662
1663         /* Read the register that contains the reason code for the panic. */
1664         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1665         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1666
1667         switch (reason) {
1668         default:
1669                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1670                 /* fallthrough */
1671         case B43_FWPANIC_DIE:
1672                 /* Do not restart the controller or firmware.
1673                  * The device is nonfunctional from now on.
1674                  * Restarting would result in this panic to trigger again,
1675                  * so we avoid that recursion. */
1676                 break;
1677         case B43_FWPANIC_RESTART:
1678                 b43_controller_restart(dev, "Microcode panic");
1679                 break;
1680         }
1681 }
1682
1683 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1684 {
1685         unsigned int i, cnt;
1686         u16 reason, marker_id, marker_line;
1687         __le16 *buf;
1688
1689         /* The proprietary firmware doesn't have this IRQ. */
1690         if (!dev->fw.opensource)
1691                 return;
1692
1693         /* Read the register that contains the reason code for this IRQ. */
1694         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1695
1696         switch (reason) {
1697         case B43_DEBUGIRQ_PANIC:
1698                 b43_handle_firmware_panic(dev);
1699                 break;
1700         case B43_DEBUGIRQ_DUMP_SHM:
1701                 if (!B43_DEBUG)
1702                         break; /* Only with driver debugging enabled. */
1703                 buf = kmalloc(4096, GFP_ATOMIC);
1704                 if (!buf) {
1705                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1706                         goto out;
1707                 }
1708                 for (i = 0; i < 4096; i += 2) {
1709                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1710                         buf[i / 2] = cpu_to_le16(tmp);
1711                 }
1712                 b43info(dev->wl, "Shared memory dump:\n");
1713                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1714                                16, 2, buf, 4096, 1);
1715                 kfree(buf);
1716                 break;
1717         case B43_DEBUGIRQ_DUMP_REGS:
1718                 if (!B43_DEBUG)
1719                         break; /* Only with driver debugging enabled. */
1720                 b43info(dev->wl, "Microcode register dump:\n");
1721                 for (i = 0, cnt = 0; i < 64; i++) {
1722                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1723                         if (cnt == 0)
1724                                 printk(KERN_INFO);
1725                         printk("r%02u: 0x%04X  ", i, tmp);
1726                         cnt++;
1727                         if (cnt == 6) {
1728                                 printk("\n");
1729                                 cnt = 0;
1730                         }
1731                 }
1732                 printk("\n");
1733                 break;
1734         case B43_DEBUGIRQ_MARKER:
1735                 if (!B43_DEBUG)
1736                         break; /* Only with driver debugging enabled. */
1737                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1738                                            B43_MARKER_ID_REG);
1739                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1740                                              B43_MARKER_LINE_REG);
1741                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1742                         "at line number %u\n",
1743                         marker_id, marker_line);
1744                 break;
1745         default:
1746                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1747                        reason);
1748         }
1749 out:
1750         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1751         b43_shm_write16(dev, B43_SHM_SCRATCH,
1752                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1753 }
1754
1755 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1756 {
1757         u32 reason;
1758         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1759         u32 merged_dma_reason = 0;
1760         int i;
1761
1762         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1763                 return;
1764
1765         reason = dev->irq_reason;
1766         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1767                 dma_reason[i] = dev->dma_reason[i];
1768                 merged_dma_reason |= dma_reason[i];
1769         }
1770
1771         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1772                 b43err(dev->wl, "MAC transmission error\n");
1773
1774         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1775                 b43err(dev->wl, "PHY transmission error\n");
1776                 rmb();
1777                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1778                         atomic_set(&dev->phy.txerr_cnt,
1779                                    B43_PHY_TX_BADNESS_LIMIT);
1780                         b43err(dev->wl, "Too many PHY TX errors, "
1781                                         "restarting the controller\n");
1782                         b43_controller_restart(dev, "PHY TX errors");
1783                 }
1784         }
1785
1786         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1787                                           B43_DMAIRQ_NONFATALMASK))) {
1788                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1789                         b43err(dev->wl, "Fatal DMA error: "
1790                                "0x%08X, 0x%08X, 0x%08X, "
1791                                "0x%08X, 0x%08X, 0x%08X\n",
1792                                dma_reason[0], dma_reason[1],
1793                                dma_reason[2], dma_reason[3],
1794                                dma_reason[4], dma_reason[5]);
1795                         b43err(dev->wl, "This device does not support DMA "
1796                                "on your system. Please use PIO instead.\n");
1797                         b43err(dev->wl, "Unload the b43 module and reload "
1798                                "with 'pio=1'\n");
1799                         return;
1800                 }
1801                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1802                         b43err(dev->wl, "DMA error: "
1803                                "0x%08X, 0x%08X, 0x%08X, "
1804                                "0x%08X, 0x%08X, 0x%08X\n",
1805                                dma_reason[0], dma_reason[1],
1806                                dma_reason[2], dma_reason[3],
1807                                dma_reason[4], dma_reason[5]);
1808                 }
1809         }
1810
1811         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1812                 handle_irq_ucode_debug(dev);
1813         if (reason & B43_IRQ_TBTT_INDI)
1814                 handle_irq_tbtt_indication(dev);
1815         if (reason & B43_IRQ_ATIM_END)
1816                 handle_irq_atim_end(dev);
1817         if (reason & B43_IRQ_BEACON)
1818                 handle_irq_beacon(dev);
1819         if (reason & B43_IRQ_PMQ)
1820                 handle_irq_pmq(dev);
1821         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1822                 ;/* TODO */
1823         if (reason & B43_IRQ_NOISESAMPLE_OK)
1824                 handle_irq_noise(dev);
1825
1826         /* Check the DMA reason registers for received data. */
1827         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1828                 if (b43_using_pio_transfers(dev))
1829                         b43_pio_rx(dev->pio.rx_queue);
1830                 else
1831                         b43_dma_rx(dev->dma.rx_ring);
1832         }
1833         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1834         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1835         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1836         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1837         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1838
1839         if (reason & B43_IRQ_TX_OK)
1840                 handle_irq_transmit_status(dev);
1841
1842         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1843         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1844
1845 #if B43_DEBUG
1846         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1847                 dev->irq_count++;
1848                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1849                         if (reason & (1 << i))
1850                                 dev->irq_bit_count[i]++;
1851                 }
1852         }
1853 #endif
1854 }
1855
1856 /* Interrupt thread handler. Handles device interrupts in thread context. */
1857 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1858 {
1859         struct b43_wldev *dev = dev_id;
1860
1861         mutex_lock(&dev->wl->mutex);
1862         b43_do_interrupt_thread(dev);
1863         mmiowb();
1864         mutex_unlock(&dev->wl->mutex);
1865
1866         return IRQ_HANDLED;
1867 }
1868
1869 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1870 {
1871         u32 reason;
1872
1873         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1874          * On SDIO, this runs under wl->mutex. */
1875
1876         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1877         if (reason == 0xffffffff)       /* shared IRQ */
1878                 return IRQ_NONE;
1879         reason &= dev->irq_mask;
1880         if (!reason)
1881                 return IRQ_HANDLED;
1882
1883         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1884             & 0x0001DC00;
1885         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1886             & 0x0000DC00;
1887         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1888             & 0x0000DC00;
1889         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1890             & 0x0001DC00;
1891         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1892             & 0x0000DC00;
1893 /* Unused ring
1894         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1895             & 0x0000DC00;
1896 */
1897
1898         /* ACK the interrupt. */
1899         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1900         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1901         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1902         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1903         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1904         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1905 /* Unused ring
1906         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1907 */
1908
1909         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1910         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1911         /* Save the reason bitmasks for the IRQ thread handler. */
1912         dev->irq_reason = reason;
1913
1914         return IRQ_WAKE_THREAD;
1915 }
1916
1917 /* Interrupt handler top-half. This runs with interrupts disabled. */
1918 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1919 {
1920         struct b43_wldev *dev = dev_id;
1921         irqreturn_t ret;
1922
1923         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1924                 return IRQ_NONE;
1925
1926         spin_lock(&dev->wl->hardirq_lock);
1927         ret = b43_do_interrupt(dev);
1928         mmiowb();
1929         spin_unlock(&dev->wl->hardirq_lock);
1930
1931         return ret;
1932 }
1933
1934 /* SDIO interrupt handler. This runs in process context. */
1935 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1936 {
1937         struct b43_wl *wl = dev->wl;
1938         irqreturn_t ret;
1939
1940         mutex_lock(&wl->mutex);
1941
1942         ret = b43_do_interrupt(dev);
1943         if (ret == IRQ_WAKE_THREAD)
1944                 b43_do_interrupt_thread(dev);
1945
1946         mutex_unlock(&wl->mutex);
1947 }
1948
1949 void b43_do_release_fw(struct b43_firmware_file *fw)
1950 {
1951         release_firmware(fw->data);
1952         fw->data = NULL;
1953         fw->filename = NULL;
1954 }
1955
1956 static void b43_release_firmware(struct b43_wldev *dev)
1957 {
1958         b43_do_release_fw(&dev->fw.ucode);
1959         b43_do_release_fw(&dev->fw.pcm);
1960         b43_do_release_fw(&dev->fw.initvals);
1961         b43_do_release_fw(&dev->fw.initvals_band);
1962 }
1963
1964 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1965 {
1966         const char text[] =
1967                 "You must go to " \
1968                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1969                 "and download the correct firmware for this driver version. " \
1970                 "Please carefully read all instructions on this website.\n";
1971
1972         if (error)
1973                 b43err(wl, text);
1974         else
1975                 b43warn(wl, text);
1976 }
1977
1978 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1979                       const char *name,
1980                       struct b43_firmware_file *fw)
1981 {
1982         const struct firmware *blob;
1983         struct b43_fw_header *hdr;
1984         u32 size;
1985         int err;
1986
1987         if (!name) {
1988                 /* Don't fetch anything. Free possibly cached firmware. */
1989                 /* FIXME: We should probably keep it anyway, to save some headache
1990                  * on suspend/resume with multiband devices. */
1991                 b43_do_release_fw(fw);
1992                 return 0;
1993         }
1994         if (fw->filename) {
1995                 if ((fw->type == ctx->req_type) &&
1996                     (strcmp(fw->filename, name) == 0))
1997                         return 0; /* Already have this fw. */
1998                 /* Free the cached firmware first. */
1999                 /* FIXME: We should probably do this later after we successfully
2000                  * got the new fw. This could reduce headache with multiband devices.
2001                  * We could also redesign this to cache the firmware for all possible
2002                  * bands all the time. */
2003                 b43_do_release_fw(fw);
2004         }
2005
2006         switch (ctx->req_type) {
2007         case B43_FWTYPE_PROPRIETARY:
2008                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2009                          "b43%s/%s.fw",
2010                          modparam_fwpostfix, name);
2011                 break;
2012         case B43_FWTYPE_OPENSOURCE:
2013                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2014                          "b43-open%s/%s.fw",
2015                          modparam_fwpostfix, name);
2016                 break;
2017         default:
2018                 B43_WARN_ON(1);
2019                 return -ENOSYS;
2020         }
2021         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2022         if (err == -ENOENT) {
2023                 snprintf(ctx->errors[ctx->req_type],
2024                          sizeof(ctx->errors[ctx->req_type]),
2025                          "Firmware file \"%s\" not found\n", ctx->fwname);
2026                 return err;
2027         } else if (err) {
2028                 snprintf(ctx->errors[ctx->req_type],
2029                          sizeof(ctx->errors[ctx->req_type]),
2030                          "Firmware file \"%s\" request failed (err=%d)\n",
2031                          ctx->fwname, err);
2032                 return err;
2033         }
2034         if (blob->size < sizeof(struct b43_fw_header))
2035                 goto err_format;
2036         hdr = (struct b43_fw_header *)(blob->data);
2037         switch (hdr->type) {
2038         case B43_FW_TYPE_UCODE:
2039         case B43_FW_TYPE_PCM:
2040                 size = be32_to_cpu(hdr->size);
2041                 if (size != blob->size - sizeof(struct b43_fw_header))
2042                         goto err_format;
2043                 /* fallthrough */
2044         case B43_FW_TYPE_IV:
2045                 if (hdr->ver != 1)
2046                         goto err_format;
2047                 break;
2048         default:
2049                 goto err_format;
2050         }
2051
2052         fw->data = blob;
2053         fw->filename = name;
2054         fw->type = ctx->req_type;
2055
2056         return 0;
2057
2058 err_format:
2059         snprintf(ctx->errors[ctx->req_type],
2060                  sizeof(ctx->errors[ctx->req_type]),
2061                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2062         release_firmware(blob);
2063
2064         return -EPROTO;
2065 }
2066
2067 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2068 {
2069         struct b43_wldev *dev = ctx->dev;
2070         struct b43_firmware *fw = &ctx->dev->fw;
2071         const u8 rev = ctx->dev->dev->id.revision;
2072         const char *filename;
2073         u32 tmshigh;
2074         int err;
2075
2076         /* Get microcode */
2077         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2078         if ((rev >= 5) && (rev <= 10))
2079                 filename = "ucode5";
2080         else if ((rev >= 11) && (rev <= 12))
2081                 filename = "ucode11";
2082         else if (rev == 13)
2083                 filename = "ucode13";
2084         else if (rev == 14)
2085                 filename = "ucode14";
2086         else if (rev >= 15)
2087                 filename = "ucode15";
2088         else
2089                 goto err_no_ucode;
2090         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2091         if (err)
2092                 goto err_load;
2093
2094         /* Get PCM code */
2095         if ((rev >= 5) && (rev <= 10))
2096                 filename = "pcm5";
2097         else if (rev >= 11)
2098                 filename = NULL;
2099         else
2100                 goto err_no_pcm;
2101         fw->pcm_request_failed = 0;
2102         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2103         if (err == -ENOENT) {
2104                 /* We did not find a PCM file? Not fatal, but
2105                  * core rev <= 10 must do without hwcrypto then. */
2106                 fw->pcm_request_failed = 1;
2107         } else if (err)
2108                 goto err_load;
2109
2110         /* Get initvals */
2111         switch (dev->phy.type) {
2112         case B43_PHYTYPE_A:
2113                 if ((rev >= 5) && (rev <= 10)) {
2114                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2115                                 filename = "a0g1initvals5";
2116                         else
2117                                 filename = "a0g0initvals5";
2118                 } else
2119                         goto err_no_initvals;
2120                 break;
2121         case B43_PHYTYPE_G:
2122                 if ((rev >= 5) && (rev <= 10))
2123                         filename = "b0g0initvals5";
2124                 else if (rev >= 13)
2125                         filename = "b0g0initvals13";
2126                 else
2127                         goto err_no_initvals;
2128                 break;
2129         case B43_PHYTYPE_N:
2130                 if ((rev >= 11) && (rev <= 12))
2131                         filename = "n0initvals11";
2132                 else
2133                         goto err_no_initvals;
2134                 break;
2135         case B43_PHYTYPE_LP:
2136                 if (rev == 13)
2137                         filename = "lp0initvals13";
2138                 else if (rev == 14)
2139                         filename = "lp0initvals14";
2140                 else if (rev >= 15)
2141                         filename = "lp0initvals15";
2142                 else
2143                         goto err_no_initvals;
2144                 break;
2145         default:
2146                 goto err_no_initvals;
2147         }
2148         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2149         if (err)
2150                 goto err_load;
2151
2152         /* Get bandswitch initvals */
2153         switch (dev->phy.type) {
2154         case B43_PHYTYPE_A:
2155                 if ((rev >= 5) && (rev <= 10)) {
2156                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2157                                 filename = "a0g1bsinitvals5";
2158                         else
2159                                 filename = "a0g0bsinitvals5";
2160                 } else if (rev >= 11)
2161                         filename = NULL;
2162                 else
2163                         goto err_no_initvals;
2164                 break;
2165         case B43_PHYTYPE_G:
2166                 if ((rev >= 5) && (rev <= 10))
2167                         filename = "b0g0bsinitvals5";
2168                 else if (rev >= 11)
2169                         filename = NULL;
2170                 else
2171                         goto err_no_initvals;
2172                 break;
2173         case B43_PHYTYPE_N:
2174                 if ((rev >= 11) && (rev <= 12))
2175                         filename = "n0bsinitvals11";
2176                 else
2177                         goto err_no_initvals;
2178                 break;
2179         case B43_PHYTYPE_LP:
2180                 if (rev == 13)
2181                         filename = "lp0bsinitvals13";
2182                 else if (rev == 14)
2183                         filename = "lp0bsinitvals14";
2184                 else if (rev >= 15)
2185                         filename = "lp0bsinitvals15";
2186                 else
2187                         goto err_no_initvals;
2188                 break;
2189         default:
2190                 goto err_no_initvals;
2191         }
2192         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2193         if (err)
2194                 goto err_load;
2195
2196         return 0;
2197
2198 err_no_ucode:
2199         err = ctx->fatal_failure = -EOPNOTSUPP;
2200         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2201                "is required for your device (wl-core rev %u)\n", rev);
2202         goto error;
2203
2204 err_no_pcm:
2205         err = ctx->fatal_failure = -EOPNOTSUPP;
2206         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2207                "is required for your device (wl-core rev %u)\n", rev);
2208         goto error;
2209
2210 err_no_initvals:
2211         err = ctx->fatal_failure = -EOPNOTSUPP;
2212         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2213                "is required for your device (wl-core rev %u)\n", rev);
2214         goto error;
2215
2216 err_load:
2217         /* We failed to load this firmware image. The error message
2218          * already is in ctx->errors. Return and let our caller decide
2219          * what to do. */
2220         goto error;
2221
2222 error:
2223         b43_release_firmware(dev);
2224         return err;
2225 }
2226
2227 static int b43_request_firmware(struct b43_wldev *dev)
2228 {
2229         struct b43_request_fw_context *ctx;
2230         unsigned int i;
2231         int err;
2232         const char *errmsg;
2233
2234         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2235         if (!ctx)
2236                 return -ENOMEM;
2237         ctx->dev = dev;
2238
2239         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2240         err = b43_try_request_fw(ctx);
2241         if (!err)
2242                 goto out; /* Successfully loaded it. */
2243         err = ctx->fatal_failure;
2244         if (err)
2245                 goto out;
2246
2247         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2248         err = b43_try_request_fw(ctx);
2249         if (!err)
2250                 goto out; /* Successfully loaded it. */
2251         err = ctx->fatal_failure;
2252         if (err)
2253                 goto out;
2254
2255         /* Could not find a usable firmware. Print the errors. */
2256         for (i = 0; i < B43_NR_FWTYPES; i++) {
2257                 errmsg = ctx->errors[i];
2258                 if (strlen(errmsg))
2259                         b43err(dev->wl, errmsg);
2260         }
2261         b43_print_fw_helptext(dev->wl, 1);
2262         err = -ENOENT;
2263
2264 out:
2265         kfree(ctx);
2266         return err;
2267 }
2268
2269 static int b43_upload_microcode(struct b43_wldev *dev)
2270 {
2271         const size_t hdr_len = sizeof(struct b43_fw_header);
2272         const __be32 *data;
2273         unsigned int i, len;
2274         u16 fwrev, fwpatch, fwdate, fwtime;
2275         u32 tmp, macctl;
2276         int err = 0;
2277
2278         /* Jump the microcode PSM to offset 0 */
2279         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2280         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2281         macctl |= B43_MACCTL_PSM_JMP0;
2282         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2283         /* Zero out all microcode PSM registers and shared memory. */
2284         for (i = 0; i < 64; i++)
2285                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2286         for (i = 0; i < 4096; i += 2)
2287                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2288
2289         /* Upload Microcode. */
2290         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2291         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2292         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2293         for (i = 0; i < len; i++) {
2294                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2295                 udelay(10);
2296         }
2297
2298         if (dev->fw.pcm.data) {
2299                 /* Upload PCM data. */
2300                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2301                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2302                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2303                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2304                 /* No need for autoinc bit in SHM_HW */
2305                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2306                 for (i = 0; i < len; i++) {
2307                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2308                         udelay(10);
2309                 }
2310         }
2311
2312         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2313
2314         /* Start the microcode PSM */
2315         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2316         macctl &= ~B43_MACCTL_PSM_JMP0;
2317         macctl |= B43_MACCTL_PSM_RUN;
2318         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2319
2320         /* Wait for the microcode to load and respond */
2321         i = 0;
2322         while (1) {
2323                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2324                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2325                         break;
2326                 i++;
2327                 if (i >= 20) {
2328                         b43err(dev->wl, "Microcode not responding\n");
2329                         b43_print_fw_helptext(dev->wl, 1);
2330                         err = -ENODEV;
2331                         goto error;
2332                 }
2333                 msleep(50);
2334         }
2335         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2336
2337         /* Get and check the revisions. */
2338         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2339         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2340         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2341         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2342
2343         if (fwrev <= 0x128) {
2344                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2345                        "binary drivers older than version 4.x is unsupported. "
2346                        "You must upgrade your firmware files.\n");
2347                 b43_print_fw_helptext(dev->wl, 1);
2348                 err = -EOPNOTSUPP;
2349                 goto error;
2350         }
2351         dev->fw.rev = fwrev;
2352         dev->fw.patch = fwpatch;
2353         dev->fw.opensource = (fwdate == 0xFFFF);
2354
2355         /* Default to use-all-queues. */
2356         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2357         dev->qos_enabled = !!modparam_qos;
2358         /* Default to firmware/hardware crypto acceleration. */
2359         dev->hwcrypto_enabled = 1;
2360
2361         if (dev->fw.opensource) {
2362                 u16 fwcapa;
2363
2364                 /* Patchlevel info is encoded in the "time" field. */
2365                 dev->fw.patch = fwtime;
2366                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2367                         dev->fw.rev, dev->fw.patch);
2368
2369                 fwcapa = b43_fwcapa_read(dev);
2370                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2371                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2372                         /* Disable hardware crypto and fall back to software crypto. */
2373                         dev->hwcrypto_enabled = 0;
2374                 }
2375                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2376                         b43info(dev->wl, "QoS not supported by firmware\n");
2377                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2378                          * ieee80211_unregister to make sure the networking core can
2379                          * properly free possible resources. */
2380                         dev->wl->hw->queues = 1;
2381                         dev->qos_enabled = 0;
2382                 }
2383         } else {
2384                 b43info(dev->wl, "Loading firmware version %u.%u "
2385                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2386                         fwrev, fwpatch,
2387                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2388                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2389                 if (dev->fw.pcm_request_failed) {
2390                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2391                                 "Hardware accelerated cryptography is disabled.\n");
2392                         b43_print_fw_helptext(dev->wl, 0);
2393                 }
2394         }
2395
2396         if (b43_is_old_txhdr_format(dev)) {
2397                 /* We're over the deadline, but we keep support for old fw
2398                  * until it turns out to be in major conflict with something new. */
2399                 b43warn(dev->wl, "You are using an old firmware image. "
2400                         "Support for old firmware will be removed soon "
2401                         "(official deadline was July 2008).\n");
2402                 b43_print_fw_helptext(dev->wl, 0);
2403         }
2404
2405         return 0;
2406
2407 error:
2408         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2409         macctl &= ~B43_MACCTL_PSM_RUN;
2410         macctl |= B43_MACCTL_PSM_JMP0;
2411         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2412
2413         return err;
2414 }
2415
2416 static int b43_write_initvals(struct b43_wldev *dev,
2417                               const struct b43_iv *ivals,
2418                               size_t count,
2419                               size_t array_size)
2420 {
2421         const struct b43_iv *iv;
2422         u16 offset;
2423         size_t i;
2424         bool bit32;
2425
2426         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2427         iv = ivals;
2428         for (i = 0; i < count; i++) {
2429                 if (array_size < sizeof(iv->offset_size))
2430                         goto err_format;
2431                 array_size -= sizeof(iv->offset_size);
2432                 offset = be16_to_cpu(iv->offset_size);
2433                 bit32 = !!(offset & B43_IV_32BIT);
2434                 offset &= B43_IV_OFFSET_MASK;
2435                 if (offset >= 0x1000)
2436                         goto err_format;
2437                 if (bit32) {
2438                         u32 value;
2439
2440                         if (array_size < sizeof(iv->data.d32))
2441                                 goto err_format;
2442                         array_size -= sizeof(iv->data.d32);
2443
2444                         value = get_unaligned_be32(&iv->data.d32);
2445                         b43_write32(dev, offset, value);
2446
2447                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2448                                                         sizeof(__be16) +
2449                                                         sizeof(__be32));
2450                 } else {
2451                         u16 value;
2452
2453                         if (array_size < sizeof(iv->data.d16))
2454                                 goto err_format;
2455                         array_size -= sizeof(iv->data.d16);
2456
2457                         value = be16_to_cpu(iv->data.d16);
2458                         b43_write16(dev, offset, value);
2459
2460                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2461                                                         sizeof(__be16) +
2462                                                         sizeof(__be16));
2463                 }
2464         }
2465         if (array_size)
2466                 goto err_format;
2467
2468         return 0;
2469
2470 err_format:
2471         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2472         b43_print_fw_helptext(dev->wl, 1);
2473
2474         return -EPROTO;
2475 }
2476
2477 static int b43_upload_initvals(struct b43_wldev *dev)
2478 {
2479         const size_t hdr_len = sizeof(struct b43_fw_header);
2480         const struct b43_fw_header *hdr;
2481         struct b43_firmware *fw = &dev->fw;
2482         const struct b43_iv *ivals;
2483         size_t count;
2484         int err;
2485
2486         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2487         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2488         count = be32_to_cpu(hdr->size);
2489         err = b43_write_initvals(dev, ivals, count,
2490                                  fw->initvals.data->size - hdr_len);
2491         if (err)
2492                 goto out;
2493         if (fw->initvals_band.data) {
2494                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2495                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2496                 count = be32_to_cpu(hdr->size);
2497                 err = b43_write_initvals(dev, ivals, count,
2498                                          fw->initvals_band.data->size - hdr_len);
2499                 if (err)
2500                         goto out;
2501         }
2502 out:
2503
2504         return err;
2505 }
2506
2507 /* Initialize the GPIOs
2508  * http://bcm-specs.sipsolutions.net/GPIO
2509  */
2510 static int b43_gpio_init(struct b43_wldev *dev)
2511 {
2512         struct ssb_bus *bus = dev->dev->bus;
2513         struct ssb_device *gpiodev, *pcidev = NULL;
2514         u32 mask, set;
2515
2516         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2517                     & ~B43_MACCTL_GPOUTSMSK);
2518
2519         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2520                     | 0x000F);
2521
2522         mask = 0x0000001F;
2523         set = 0x0000000F;
2524         if (dev->dev->bus->chip_id == 0x4301) {
2525                 mask |= 0x0060;
2526                 set |= 0x0060;
2527         }
2528         if (0 /* FIXME: conditional unknown */ ) {
2529                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2530                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2531                             | 0x0100);
2532                 mask |= 0x0180;
2533                 set |= 0x0180;
2534         }
2535         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2536                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2537                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2538                             | 0x0200);
2539                 mask |= 0x0200;
2540                 set |= 0x0200;
2541         }
2542         if (dev->dev->id.revision >= 2)
2543                 mask |= 0x0010; /* FIXME: This is redundant. */
2544
2545 #ifdef CONFIG_SSB_DRIVER_PCICORE
2546         pcidev = bus->pcicore.dev;
2547 #endif
2548         gpiodev = bus->chipco.dev ? : pcidev;
2549         if (!gpiodev)
2550                 return 0;
2551         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2552                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2553                      & mask) | set);
2554
2555         return 0;
2556 }
2557
2558 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2559 static void b43_gpio_cleanup(struct b43_wldev *dev)
2560 {
2561         struct ssb_bus *bus = dev->dev->bus;
2562         struct ssb_device *gpiodev, *pcidev = NULL;
2563
2564 #ifdef CONFIG_SSB_DRIVER_PCICORE
2565         pcidev = bus->pcicore.dev;
2566 #endif
2567         gpiodev = bus->chipco.dev ? : pcidev;
2568         if (!gpiodev)
2569                 return;
2570         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2571 }
2572
2573 /* http://bcm-specs.sipsolutions.net/EnableMac */
2574 void b43_mac_enable(struct b43_wldev *dev)
2575 {
2576         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2577                 u16 fwstate;
2578
2579                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2580                                          B43_SHM_SH_UCODESTAT);
2581                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2582                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2583                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2584                                "should be suspended, but current state is %u\n",
2585                                fwstate);
2586                 }
2587         }
2588
2589         dev->mac_suspended--;
2590         B43_WARN_ON(dev->mac_suspended < 0);
2591         if (dev->mac_suspended == 0) {
2592                 b43_write32(dev, B43_MMIO_MACCTL,
2593                             b43_read32(dev, B43_MMIO_MACCTL)
2594                             | B43_MACCTL_ENABLED);
2595                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2596                             B43_IRQ_MAC_SUSPENDED);
2597                 /* Commit writes */
2598                 b43_read32(dev, B43_MMIO_MACCTL);
2599                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2600                 b43_power_saving_ctl_bits(dev, 0);
2601         }
2602 }
2603
2604 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2605 void b43_mac_suspend(struct b43_wldev *dev)
2606 {
2607         int i;
2608         u32 tmp;
2609
2610         might_sleep();
2611         B43_WARN_ON(dev->mac_suspended < 0);
2612
2613         if (dev->mac_suspended == 0) {
2614                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2615                 b43_write32(dev, B43_MMIO_MACCTL,
2616                             b43_read32(dev, B43_MMIO_MACCTL)
2617                             & ~B43_MACCTL_ENABLED);
2618                 /* force pci to flush the write */
2619                 b43_read32(dev, B43_MMIO_MACCTL);
2620                 for (i = 35; i; i--) {
2621                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2622                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2623                                 goto out;
2624                         udelay(10);
2625                 }
2626                 /* Hm, it seems this will take some time. Use msleep(). */
2627                 for (i = 40; i; i--) {
2628                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2629                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2630                                 goto out;
2631                         msleep(1);
2632                 }
2633                 b43err(dev->wl, "MAC suspend failed\n");
2634         }
2635 out:
2636         dev->mac_suspended++;
2637 }
2638
2639 static void b43_adjust_opmode(struct b43_wldev *dev)
2640 {
2641         struct b43_wl *wl = dev->wl;
2642         u32 ctl;
2643         u16 cfp_pretbtt;
2644
2645         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2646         /* Reset status to STA infrastructure mode. */
2647         ctl &= ~B43_MACCTL_AP;
2648         ctl &= ~B43_MACCTL_KEEP_CTL;
2649         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2650         ctl &= ~B43_MACCTL_KEEP_BAD;
2651         ctl &= ~B43_MACCTL_PROMISC;
2652         ctl &= ~B43_MACCTL_BEACPROMISC;
2653         ctl |= B43_MACCTL_INFRA;
2654
2655         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2656             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2657                 ctl |= B43_MACCTL_AP;
2658         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2659                 ctl &= ~B43_MACCTL_INFRA;
2660
2661         if (wl->filter_flags & FIF_CONTROL)
2662                 ctl |= B43_MACCTL_KEEP_CTL;
2663         if (wl->filter_flags & FIF_FCSFAIL)
2664                 ctl |= B43_MACCTL_KEEP_BAD;
2665         if (wl->filter_flags & FIF_PLCPFAIL)
2666                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2667         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2668                 ctl |= B43_MACCTL_PROMISC;
2669         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2670                 ctl |= B43_MACCTL_BEACPROMISC;
2671
2672         /* Workaround: On old hardware the HW-MAC-address-filter
2673          * doesn't work properly, so always run promisc in filter
2674          * it in software. */
2675         if (dev->dev->id.revision <= 4)
2676                 ctl |= B43_MACCTL_PROMISC;
2677
2678         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2679
2680         cfp_pretbtt = 2;
2681         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2682                 if (dev->dev->bus->chip_id == 0x4306 &&
2683                     dev->dev->bus->chip_rev == 3)
2684                         cfp_pretbtt = 100;
2685                 else
2686                         cfp_pretbtt = 50;
2687         }
2688         b43_write16(dev, 0x612, cfp_pretbtt);
2689
2690         /* FIXME: We don't currently implement the PMQ mechanism,
2691          *        so always disable it. If we want to implement PMQ,
2692          *        we need to enable it here (clear DISCPMQ) in AP mode.
2693          */
2694         if (0  /* ctl & B43_MACCTL_AP */) {
2695                 b43_write32(dev, B43_MMIO_MACCTL,
2696                             b43_read32(dev, B43_MMIO_MACCTL)
2697                             & ~B43_MACCTL_DISCPMQ);
2698         } else {
2699                 b43_write32(dev, B43_MMIO_MACCTL,
2700                             b43_read32(dev, B43_MMIO_MACCTL)
2701                             | B43_MACCTL_DISCPMQ);
2702         }
2703 }
2704
2705 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2706 {
2707         u16 offset;
2708
2709         if (is_ofdm) {
2710                 offset = 0x480;
2711                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2712         } else {
2713                 offset = 0x4C0;
2714                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2715         }
2716         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2717                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2718 }
2719
2720 static void b43_rate_memory_init(struct b43_wldev *dev)
2721 {
2722         switch (dev->phy.type) {
2723         case B43_PHYTYPE_A:
2724         case B43_PHYTYPE_G:
2725         case B43_PHYTYPE_N:
2726         case B43_PHYTYPE_LP:
2727                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2728                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2729                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2730                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2731                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2732                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2733                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2734                 if (dev->phy.type == B43_PHYTYPE_A)
2735                         break;
2736                 /* fallthrough */
2737         case B43_PHYTYPE_B:
2738                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2739                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2740                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2741                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2742                 break;
2743         default:
2744                 B43_WARN_ON(1);
2745         }
2746 }
2747
2748 /* Set the default values for the PHY TX Control Words. */
2749 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2750 {
2751         u16 ctl = 0;
2752
2753         ctl |= B43_TXH_PHY_ENC_CCK;
2754         ctl |= B43_TXH_PHY_ANT01AUTO;
2755         ctl |= B43_TXH_PHY_TXPWR;
2756
2757         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2758         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2759         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2760 }
2761
2762 /* Set the TX-Antenna for management frames sent by firmware. */
2763 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2764 {
2765         u16 ant;
2766         u16 tmp;
2767
2768         ant = b43_antenna_to_phyctl(antenna);
2769
2770         /* For ACK/CTS */
2771         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2772         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2773         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2774         /* For Probe Resposes */
2775         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2776         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2777         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2778 }
2779
2780 /* This is the opposite of b43_chip_init() */
2781 static void b43_chip_exit(struct b43_wldev *dev)
2782 {
2783         b43_phy_exit(dev);
2784         b43_gpio_cleanup(dev);
2785         /* firmware is released later */
2786 }
2787
2788 /* Initialize the chip
2789  * http://bcm-specs.sipsolutions.net/ChipInit
2790  */
2791 static int b43_chip_init(struct b43_wldev *dev)
2792 {
2793         struct b43_phy *phy = &dev->phy;
2794         int err;
2795         u32 value32, macctl;
2796         u16 value16;
2797
2798         /* Initialize the MAC control */
2799         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2800         if (dev->phy.gmode)
2801                 macctl |= B43_MACCTL_GMODE;
2802         macctl |= B43_MACCTL_INFRA;
2803         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2804
2805         err = b43_request_firmware(dev);
2806         if (err)
2807                 goto out;
2808         err = b43_upload_microcode(dev);
2809         if (err)
2810                 goto out;       /* firmware is released later */
2811
2812         err = b43_gpio_init(dev);
2813         if (err)
2814                 goto out;       /* firmware is released later */
2815
2816         err = b43_upload_initvals(dev);
2817         if (err)
2818                 goto err_gpio_clean;
2819
2820         /* Turn the Analog on and initialize the PHY. */
2821         phy->ops->switch_analog(dev, 1);
2822         err = b43_phy_init(dev);
2823         if (err)
2824                 goto err_gpio_clean;
2825
2826         /* Disable Interference Mitigation. */
2827         if (phy->ops->interf_mitigation)
2828                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2829
2830         /* Select the antennae */
2831         if (phy->ops->set_rx_antenna)
2832                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2833         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2834
2835         if (phy->type == B43_PHYTYPE_B) {
2836                 value16 = b43_read16(dev, 0x005E);
2837                 value16 |= 0x0004;
2838                 b43_write16(dev, 0x005E, value16);
2839         }
2840         b43_write32(dev, 0x0100, 0x01000000);
2841         if (dev->dev->id.revision < 5)
2842                 b43_write32(dev, 0x010C, 0x01000000);
2843
2844         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2845                     & ~B43_MACCTL_INFRA);
2846         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2847                     | B43_MACCTL_INFRA);
2848
2849         /* Probe Response Timeout value */
2850         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2851         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2852
2853         /* Initially set the wireless operation mode. */
2854         b43_adjust_opmode(dev);
2855
2856         if (dev->dev->id.revision < 3) {
2857                 b43_write16(dev, 0x060E, 0x0000);
2858                 b43_write16(dev, 0x0610, 0x8000);
2859                 b43_write16(dev, 0x0604, 0x0000);
2860                 b43_write16(dev, 0x0606, 0x0200);
2861         } else {
2862                 b43_write32(dev, 0x0188, 0x80000000);
2863                 b43_write32(dev, 0x018C, 0x02000000);
2864         }
2865         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2866         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2867         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2868         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2869         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2870         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2871         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2872
2873         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2874         value32 |= 0x00100000;
2875         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2876
2877         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2878                     dev->dev->bus->chipco.fast_pwrup_delay);
2879
2880         err = 0;
2881         b43dbg(dev->wl, "Chip initialized\n");
2882 out:
2883         return err;
2884
2885 err_gpio_clean:
2886         b43_gpio_cleanup(dev);
2887         return err;
2888 }
2889
2890 static void b43_periodic_every60sec(struct b43_wldev *dev)
2891 {
2892         const struct b43_phy_operations *ops = dev->phy.ops;
2893
2894         if (ops->pwork_60sec)
2895                 ops->pwork_60sec(dev);
2896
2897         /* Force check the TX power emission now. */
2898         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2899 }
2900
2901 static void b43_periodic_every30sec(struct b43_wldev *dev)
2902 {
2903         /* Update device statistics. */
2904         b43_calculate_link_quality(dev);
2905 }
2906
2907 static void b43_periodic_every15sec(struct b43_wldev *dev)
2908 {
2909         struct b43_phy *phy = &dev->phy;
2910         u16 wdr;
2911
2912         if (dev->fw.opensource) {
2913                 /* Check if the firmware is still alive.
2914                  * It will reset the watchdog counter to 0 in its idle loop. */
2915                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2916                 if (unlikely(wdr)) {
2917                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2918                         b43_controller_restart(dev, "Firmware watchdog");
2919                         return;
2920                 } else {
2921                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2922                                         B43_WATCHDOG_REG, 1);
2923                 }
2924         }
2925
2926         if (phy->ops->pwork_15sec)
2927                 phy->ops->pwork_15sec(dev);
2928
2929         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2930         wmb();
2931
2932 #if B43_DEBUG
2933         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2934                 unsigned int i;
2935
2936                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
2937                        dev->irq_count / 15,
2938                        dev->tx_count / 15,
2939                        dev->rx_count / 15);
2940                 dev->irq_count = 0;
2941                 dev->tx_count = 0;
2942                 dev->rx_count = 0;
2943                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2944                         if (dev->irq_bit_count[i]) {
2945                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
2946                                        dev->irq_bit_count[i] / 15, i, (1 << i));
2947                                 dev->irq_bit_count[i] = 0;
2948                         }
2949                 }
2950         }
2951 #endif
2952 }
2953
2954 static void do_periodic_work(struct b43_wldev *dev)
2955 {
2956         unsigned int state;
2957
2958         state = dev->periodic_state;
2959         if (state % 4 == 0)
2960                 b43_periodic_every60sec(dev);
2961         if (state % 2 == 0)
2962                 b43_periodic_every30sec(dev);
2963         b43_periodic_every15sec(dev);
2964 }
2965
2966 /* Periodic work locking policy:
2967  *      The whole periodic work handler is protected by
2968  *      wl->mutex. If another lock is needed somewhere in the
2969  *      pwork callchain, it's aquired in-place, where it's needed.
2970  */
2971 static void b43_periodic_work_handler(struct work_struct *work)
2972 {
2973         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2974                                              periodic_work.work);
2975         struct b43_wl *wl = dev->wl;
2976         unsigned long delay;
2977
2978         mutex_lock(&wl->mutex);
2979
2980         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2981                 goto out;
2982         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2983                 goto out_requeue;
2984
2985         do_periodic_work(dev);
2986
2987         dev->periodic_state++;
2988 out_requeue:
2989         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2990                 delay = msecs_to_jiffies(50);
2991         else
2992                 delay = round_jiffies_relative(HZ * 15);
2993         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2994 out:
2995         mutex_unlock(&wl->mutex);
2996 }
2997
2998 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2999 {
3000         struct delayed_work *work = &dev->periodic_work;
3001
3002         dev->periodic_state = 0;
3003         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3004         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3005 }
3006
3007 /* Check if communication with the device works correctly. */
3008 static int b43_validate_chipaccess(struct b43_wldev *dev)
3009 {
3010         u32 v, backup0, backup4;
3011
3012         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3013         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3014
3015         /* Check for read/write and endianness problems. */
3016         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3017         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3018                 goto error;
3019         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3020         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3021                 goto error;
3022
3023         /* Check if unaligned 32bit SHM_SHARED access works properly.
3024          * However, don't bail out on failure, because it's noncritical. */
3025         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3026         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3027         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3028         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3029         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3030                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3031         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3032         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3033             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3034             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3035             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3036                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3037
3038         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3039         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3040
3041         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3042                 /* The 32bit register shadows the two 16bit registers
3043                  * with update sideeffects. Validate this. */
3044                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3045                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3046                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3047                         goto error;
3048                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)