drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_qos = 1;
  84 module_param_named(qos, modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  94
  95
  96 static const struct ssb_device_id b43_ssb_tbl[] = {
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 106         SSB_DEVTABLE_END
 107 };
 108
 109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 110
 111 /* Channel and ratetables are shared for all devices.
 112  * They can't be const, because ieee80211 puts some precalculated
 113  * data in there. This data is the same for all devices, so we don't
 114  * get concurrency issues */
 115 #define RATETAB_ENT(_rateid, _flags) \
 116         {                                                               \
 117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 118                 .hw_value       = (_rateid),                            \
 119                 .flags          = (_flags),                             \
 120         }
 121
 122 /*
 123  * NOTE: When changing this, sync with xmit.c's
 124  *       b43_plcp_get_bitrate_idx_* functions!
 125  */
 126 static struct ieee80211_rate __b43_ratetable[] = {
 127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 139 };
 140
 141 #define b43_a_ratetable         (__b43_ratetable + 4)
 142 #define b43_a_ratetable_size    8
 143 #define b43_b_ratetable         (__b43_ratetable + 0)
 144 #define b43_b_ratetable_size    4
 145 #define b43_g_ratetable         (__b43_ratetable + 0)
 146 #define b43_g_ratetable_size    12
 147
 148 #define CHAN4G(_channel, _freq, _flags) {                       \
 149         .band                   = IEEE80211_BAND_2GHZ,          \
 150         .center_freq            = (_freq),                      \
 151         .hw_value               = (_channel),                   \
 152         .flags                  = (_flags),                     \
 153         .max_antenna_gain       = 0,                            \
 154         .max_power              = 30,                           \
 155 }
 156 static struct ieee80211_channel b43_2ghz_chantable[] = {
 157         CHAN4G(1, 2412, 0),
 158         CHAN4G(2, 2417, 0),
 159         CHAN4G(3, 2422, 0),
 160         CHAN4G(4, 2427, 0),
 161         CHAN4G(5, 2432, 0),
 162         CHAN4G(6, 2437, 0),
 163         CHAN4G(7, 2442, 0),
 164         CHAN4G(8, 2447, 0),
 165         CHAN4G(9, 2452, 0),
 166         CHAN4G(10, 2457, 0),
 167         CHAN4G(11, 2462, 0),
 168         CHAN4G(12, 2467, 0),
 169         CHAN4G(13, 2472, 0),
 170         CHAN4G(14, 2484, 0),
 171 };
 172 #undef CHAN4G
 173
 174 #define CHAN5G(_channel, _flags) {                              \
 175         .band                   = IEEE80211_BAND_5GHZ,          \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .flags                  = (_flags),                     \
 179         .max_antenna_gain       = 0,                            \
 180         .max_power              = 30,                           \
 181 }
 182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 183         CHAN5G(32, 0),          CHAN5G(34, 0),
 184         CHAN5G(36, 0),          CHAN5G(38, 0),
 185         CHAN5G(40, 0),          CHAN5G(42, 0),
 186         CHAN5G(44, 0),          CHAN5G(46, 0),
 187         CHAN5G(48, 0),          CHAN5G(50, 0),
 188         CHAN5G(52, 0),          CHAN5G(54, 0),
 189         CHAN5G(56, 0),          CHAN5G(58, 0),
 190         CHAN5G(60, 0),          CHAN5G(62, 0),
 191         CHAN5G(64, 0),          CHAN5G(66, 0),
 192         CHAN5G(68, 0),          CHAN5G(70, 0),
 193         CHAN5G(72, 0),          CHAN5G(74, 0),
 194         CHAN5G(76, 0),          CHAN5G(78, 0),
 195         CHAN5G(80, 0),          CHAN5G(82, 0),
 196         CHAN5G(84, 0),          CHAN5G(86, 0),
 197         CHAN5G(88, 0),          CHAN5G(90, 0),
 198         CHAN5G(92, 0),          CHAN5G(94, 0),
 199         CHAN5G(96, 0),          CHAN5G(98, 0),
 200         CHAN5G(100, 0),         CHAN5G(102, 0),
 201         CHAN5G(104, 0),         CHAN5G(106, 0),
 202         CHAN5G(108, 0),         CHAN5G(110, 0),
 203         CHAN5G(112, 0),         CHAN5G(114, 0),
 204         CHAN5G(116, 0),         CHAN5G(118, 0),
 205         CHAN5G(120, 0),         CHAN5G(122, 0),
 206         CHAN5G(124, 0),         CHAN5G(126, 0),
 207         CHAN5G(128, 0),         CHAN5G(130, 0),
 208         CHAN5G(132, 0),         CHAN5G(134, 0),
 209         CHAN5G(136, 0),         CHAN5G(138, 0),
 210         CHAN5G(140, 0),         CHAN5G(142, 0),
 211         CHAN5G(144, 0),         CHAN5G(145, 0),
 212         CHAN5G(146, 0),         CHAN5G(147, 0),
 213         CHAN5G(148, 0),         CHAN5G(149, 0),
 214         CHAN5G(150, 0),         CHAN5G(151, 0),
 215         CHAN5G(152, 0),         CHAN5G(153, 0),
 216         CHAN5G(154, 0),         CHAN5G(155, 0),
 217         CHAN5G(156, 0),         CHAN5G(157, 0),
 218         CHAN5G(158, 0),         CHAN5G(159, 0),
 219         CHAN5G(160, 0),         CHAN5G(161, 0),
 220         CHAN5G(162, 0),         CHAN5G(163, 0),
 221         CHAN5G(164, 0),         CHAN5G(165, 0),
 222         CHAN5G(166, 0),         CHAN5G(168, 0),
 223         CHAN5G(170, 0),         CHAN5G(172, 0),
 224         CHAN5G(174, 0),         CHAN5G(176, 0),
 225         CHAN5G(178, 0),         CHAN5G(180, 0),
 226         CHAN5G(182, 0),         CHAN5G(184, 0),
 227         CHAN5G(186, 0),         CHAN5G(188, 0),
 228         CHAN5G(190, 0),         CHAN5G(192, 0),
 229         CHAN5G(194, 0),         CHAN5G(196, 0),
 230         CHAN5G(198, 0),         CHAN5G(200, 0),
 231         CHAN5G(202, 0),         CHAN5G(204, 0),
 232         CHAN5G(206, 0),         CHAN5G(208, 0),
 233         CHAN5G(210, 0),         CHAN5G(212, 0),
 234         CHAN5G(214, 0),         CHAN5G(216, 0),
 235         CHAN5G(218, 0),         CHAN5G(220, 0),
 236         CHAN5G(222, 0),         CHAN5G(224, 0),
 237         CHAN5G(226, 0),         CHAN5G(228, 0),
 238 };
 239
 240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 241         CHAN5G(34, 0),          CHAN5G(36, 0),
 242         CHAN5G(38, 0),          CHAN5G(40, 0),
 243         CHAN5G(42, 0),          CHAN5G(44, 0),
 244         CHAN5G(46, 0),          CHAN5G(48, 0),
 245         CHAN5G(52, 0),          CHAN5G(56, 0),
 246         CHAN5G(60, 0),          CHAN5G(64, 0),
 247         CHAN5G(100, 0),         CHAN5G(104, 0),
 248         CHAN5G(108, 0),         CHAN5G(112, 0),
 249         CHAN5G(116, 0),         CHAN5G(120, 0),
 250         CHAN5G(124, 0),         CHAN5G(128, 0),
 251         CHAN5G(132, 0),         CHAN5G(136, 0),
 252         CHAN5G(140, 0),         CHAN5G(149, 0),
 253         CHAN5G(153, 0),         CHAN5G(157, 0),
 254         CHAN5G(161, 0),         CHAN5G(165, 0),
 255         CHAN5G(184, 0),         CHAN5G(188, 0),
 256         CHAN5G(192, 0),         CHAN5G(196, 0),
 257         CHAN5G(200, 0),         CHAN5G(204, 0),
 258         CHAN5G(208, 0),         CHAN5G(212, 0),
 259         CHAN5G(216, 0),
 260 };
 261 #undef CHAN5G
 262
 263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 264         .band           = IEEE80211_BAND_5GHZ,
 265         .channels       = b43_5ghz_nphy_chantable,
 266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 267         .bitrates       = b43_a_ratetable,
 268         .n_bitrates     = b43_a_ratetable_size,
 269 };
 270
 271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 272         .band           = IEEE80211_BAND_5GHZ,
 273         .channels       = b43_5ghz_aphy_chantable,
 274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 275         .bitrates       = b43_a_ratetable,
 276         .n_bitrates     = b43_a_ratetable_size,
 277 };
 278
 279 static struct ieee80211_supported_band b43_band_2GHz = {
 280         .band           = IEEE80211_BAND_2GHZ,
 281         .channels       = b43_2ghz_chantable,
 282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 283         .bitrates       = b43_g_ratetable,
 284         .n_bitrates     = b43_g_ratetable_size,
 285 };
 286
 287 static void b43_wireless_core_exit(struct b43_wldev *dev);
 288 static int b43_wireless_core_init(struct b43_wldev *dev);
 289 static void b43_wireless_core_stop(struct b43_wldev *dev);
 290 static int b43_wireless_core_start(struct b43_wldev *dev);
 291
 292 static int b43_ratelimit(struct b43_wl *wl)
 293 {
 294         if (!wl || !wl->current_dev)
 295                 return 1;
 296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 297                 return 1;
 298         /* We are up and running.
 299          * Ratelimit the messages to avoid DoS over the net. */
 300         return net_ratelimit();
 301 }
 302
 303 void b43info(struct b43_wl *wl, const char *fmt, ...)
 304 {
 305         va_list args;
 306
 307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 308                 return;
 309         if (!b43_ratelimit(wl))
 310                 return;
 311         va_start(args, fmt);
 312         printk(KERN_INFO "b43-%s: ",
 313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 314         vprintk(fmt, args);
 315         va_end(args);
 316 }
 317
 318 void b43err(struct b43_wl *wl, const char *fmt, ...)
 319 {
 320         va_list args;
 321
 322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 323                 return;
 324         if (!b43_ratelimit(wl))
 325                 return;
 326         va_start(args, fmt);
 327         printk(KERN_ERR "b43-%s ERROR: ",
 328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 329         vprintk(fmt, args);
 330         va_end(args);
 331 }
 332
 333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 334 {
 335         va_list args;
 336
 337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 338                 return;
 339         if (!b43_ratelimit(wl))
 340                 return;
 341         va_start(args, fmt);
 342         printk(KERN_WARNING "b43-%s warning: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347
 348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 349 {
 350         va_list args;
 351
 352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 353                 return;
 354         va_start(args, fmt);
 355         printk(KERN_DEBUG "b43-%s debug: ",
 356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 357         vprintk(fmt, args);
 358         va_end(args);
 359 }
 360
 361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 362 {
 363         u32 macctl;
 364
 365         B43_WARN_ON(offset % 4 != 0);
 366
 367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 368         if (macctl & B43_MACCTL_BE)
 369                 val = swab32(val);
 370
 371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 372         mmiowb();
 373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 374 }
 375
 376 static inline void b43_shm_control_word(struct b43_wldev *dev,
 377                                         u16 routing, u16 offset)
 378 {
 379         u32 control;
 380
 381         /* "offset" is the WORD offset. */
 382         control = routing;
 383         control <<= 16;
 384         control |= offset;
 385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 386 }
 387
 388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 389 {
 390         u32 ret;
 391
 392         if (routing == B43_SHM_SHARED) {
 393                 B43_WARN_ON(offset & 0x0001);
 394                 if (offset & 0x0003) {
 395                         /* Unaligned access */
 396                         b43_shm_control_word(dev, routing, offset >> 2);
 397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 398                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 399                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 400
 401                         goto out;
 402                 }
 403                 offset >>= 2;
 404         }
 405         b43_shm_control_word(dev, routing, offset);
 406         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 407 out:
 408         return ret;
 409 }
 410
 411 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 412 {
 413         struct b43_wl *wl = dev->wl;
 414         unsigned long flags;
 415         u32 ret;
 416
 417         spin_lock_irqsave(&wl->shm_lock, flags);
 418         ret = __b43_shm_read32(dev, routing, offset);
 419         spin_unlock_irqrestore(&wl->shm_lock, flags);
 420
 421         return ret;
 422 }
 423
 424 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 425 {
 426         u16 ret;
 427
 428         if (routing == B43_SHM_SHARED) {
 429                 B43_WARN_ON(offset & 0x0001);
 430                 if (offset & 0x0003) {
 431                         /* Unaligned access */
 432                         b43_shm_control_word(dev, routing, offset >> 2);
 433                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 434
 435                         goto out;
 436                 }
 437                 offset >>= 2;
 438         }
 439         b43_shm_control_word(dev, routing, offset);
 440         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 441 out:
 442         return ret;
 443 }
 444
 445 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 446 {
 447         struct b43_wl *wl = dev->wl;
 448         unsigned long flags;
 449         u16 ret;
 450
 451         spin_lock_irqsave(&wl->shm_lock, flags);
 452         ret = __b43_shm_read16(dev, routing, offset);
 453         spin_unlock_irqrestore(&wl->shm_lock, flags);
 454
 455         return ret;
 456 }
 457
 458 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 459 {
 460         if (routing == B43_SHM_SHARED) {
 461                 B43_WARN_ON(offset & 0x0001);
 462                 if (offset & 0x0003) {
 463                         /* Unaligned access */
 464                         b43_shm_control_word(dev, routing, offset >> 2);
 465                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 466                                     value & 0xFFFF);
 467                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 468                         b43_write16(dev, B43_MMIO_SHM_DATA,
 469                                     (value >> 16) & 0xFFFF);
 470                         return;
 471                 }
 472                 offset >>= 2;
 473         }
 474         b43_shm_control_word(dev, routing, offset);
 475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 476 }
 477
 478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 479 {
 480         struct b43_wl *wl = dev->wl;
 481         unsigned long flags;
 482
 483         spin_lock_irqsave(&wl->shm_lock, flags);
 484         __b43_shm_write32(dev, routing, offset, value);
 485         spin_unlock_irqrestore(&wl->shm_lock, flags);
 486 }
 487
 488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 496                         return;
 497                 }
 498                 offset >>= 2;
 499         }
 500         b43_shm_control_word(dev, routing, offset);
 501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 502 }
 503
 504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 505 {
 506         struct b43_wl *wl = dev->wl;
 507         unsigned long flags;
 508
 509         spin_lock_irqsave(&wl->shm_lock, flags);
 510         __b43_shm_write16(dev, routing, offset, value);
 511         spin_unlock_irqrestore(&wl->shm_lock, flags);
 512 }
 513
 514 /* Read HostFlags */
 515 u64 b43_hf_read(struct b43_wldev *dev)
 516 {
 517         u64 ret;
 518
 519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 522         ret <<= 16;
 523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 524
 525         return ret;
 526 }
 527
 528 /* Write HostFlags */
 529 void b43_hf_write(struct b43_wldev *dev, u64 value)
 530 {
 531         u16 lo, mi, hi;
 532
 533         lo = (value & 0x00000000FFFFULL);
 534         mi = (value & 0x0000FFFF0000ULL) >> 16;
 535         hi = (value & 0xFFFF00000000ULL) >> 32;
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 539 }
 540
 541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 543 {
 544         B43_WARN_ON(!dev->fw.opensource);
 545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 546 }
 547
 548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 549 {
 550         u32 low, high;
 551
 552         B43_WARN_ON(dev->dev->id.revision < 3);
 553
 554         /* The hardware guarantees us an atomic read, if we
 555          * read the low register first. */
 556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 558
 559         *tsf = high;
 560         *tsf <<= 32;
 561         *tsf |= low;
 562 }
 563
 564 static void b43_time_lock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl |= B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_time_unlock(struct b43_wldev *dev)
 576 {
 577         u32 macctl;
 578
 579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 580         macctl &= ~B43_MACCTL_TBTTHOLD;
 581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 582         /* Commit the write */
 583         b43_read32(dev, B43_MMIO_MACCTL);
 584 }
 585
 586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 587 {
 588         u32 low, high;
 589
 590         B43_WARN_ON(dev->dev->id.revision < 3);
 591
 592         low = tsf;
 593         high = (tsf >> 32);
 594         /* The hardware guarantees us an atomic write, if we
 595          * write the low register first. */
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 597         mmiowb();
 598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 599         mmiowb();
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676 }
 677
 678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 20);
 681 }
 682
 683 /* Synchronize IRQ top- and bottom-half.
 684  * IRQs must be masked before calling this.
 685  * This must not be called with the irq_lock held.
 686  */
 687 static void b43_synchronize_irq(struct b43_wldev *dev)
 688 {
 689         synchronize_irq(dev->dev->irq);
 690         tasklet_kill(&dev->isr_tasklet);
 691 }
 692
 693 /* DummyTransmission function, as documented on
 694  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 695  */
 696 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 697 {
 698         struct b43_wl *wl = dev->wl;
 699         struct b43_phy *phy = &dev->phy;
 700         unsigned int i, max_loop;
 701         u16 value;
 702         u32 buffer[5] = {
 703                 0x00000000,
 704                 0x00D40000,
 705                 0x00000000,
 706                 0x01000000,
 707                 0x00000000,
 708         };
 709
 710         if (ofdm) {
 711                 max_loop = 0x1E;
 712                 buffer[0] = 0x000201CC;
 713         } else {
 714                 max_loop = 0xFA;
 715                 buffer[0] = 0x000B846E;
 716         }
 717
 718         spin_lock_irq(&wl->irq_lock);
 719         write_lock(&wl->tx_lock);
 720
 721         for (i = 0; i < 5; i++)
 722                 b43_ram_write(dev, i * 4, buffer[i]);
 723
 724         b43_write16(dev, 0x0568, 0x0000);
 725         if (dev->dev->id.revision < 11)
 726                 b43_write16(dev, 0x07C0, 0x0000);
 727         else
 728                 b43_write16(dev, 0x07C0, 0x0100);
 729         value = (ofdm ? 0x41 : 0x40);
 730         b43_write16(dev, 0x050C, value);
 731         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 732                 b43_write16(dev, 0x0514, 0x1A02);
 733         b43_write16(dev, 0x0508, 0x0000);
 734         b43_write16(dev, 0x050A, 0x0000);
 735         b43_write16(dev, 0x054C, 0x0000);
 736         b43_write16(dev, 0x056A, 0x0014);
 737         b43_write16(dev, 0x0568, 0x0826);
 738         b43_write16(dev, 0x0500, 0x0000);
 739         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 740                 //SPEC TODO
 741         }
 742
 743         switch (phy->type) {
 744         case B43_PHYTYPE_N:
 745                 b43_write16(dev, 0x0502, 0x00D0);
 746                 break;
 747         case B43_PHYTYPE_LP:
 748                 b43_write16(dev, 0x0502, 0x0050);
 749                 break;
 750         default:
 751                 b43_write16(dev, 0x0502, 0x0030);
 752         }
 753
 754         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 755                 b43_radio_write16(dev, 0x0051, 0x0017);
 756         for (i = 0x00; i < max_loop; i++) {
 757                 value = b43_read16(dev, 0x050E);
 758                 if (value & 0x0080)
 759                         break;
 760                 udelay(10);
 761         }
 762         for (i = 0x00; i < 0x0A; i++) {
 763                 value = b43_read16(dev, 0x050E);
 764                 if (value & 0x0400)
 765                         break;
 766                 udelay(10);
 767         }
 768         for (i = 0x00; i < 0x19; i++) {
 769                 value = b43_read16(dev, 0x0690);
 770                 if (!(value & 0x0100))
 771                         break;
 772                 udelay(10);
 773         }
 774         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 775                 b43_radio_write16(dev, 0x0051, 0x0037);
 776
 777         write_unlock(&wl->tx_lock);
 778         spin_unlock_irq(&wl->irq_lock);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 static void do_key_write(struct b43_wldev *dev,
 838                          u8 index, u8 algorithm,
 839                          const u8 *key, size_t key_len, const u8 *mac_addr)
 840 {
 841         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 842         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 843
 844         if (b43_new_kidx_api(dev))
 845                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 846
 847         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 848         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 849
 850         if (index >= pairwise_keys_start)
 851                 keymac_write(dev, index, NULL); /* First zero out mac. */
 852         if (key)
 853                 memcpy(buf, key, key_len);
 854         key_write(dev, index, algorithm, buf);
 855         if (index >= pairwise_keys_start)
 856                 keymac_write(dev, index, mac_addr);
 857
 858         dev->key[index].algorithm = algorithm;
 859 }
 860
 861 static int b43_key_write(struct b43_wldev *dev,
 862                          int index, u8 algorithm,
 863                          const u8 *key, size_t key_len,
 864                          const u8 *mac_addr,
 865                          struct ieee80211_key_conf *keyconf)
 866 {
 867         int i;
 868         int pairwise_keys_start;
 869
 870         if (key_len > B43_SEC_KEYSIZE)
 871                 return -EINVAL;
 872         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 873                 /* Check that we don't already have this key. */
 874                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 875         }
 876         if (index < 0) {
 877                 /* Pairwise key. Get an empty slot for the key. */
 878                 if (b43_new_kidx_api(dev))
 879                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 880                 else
 881                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 882                 for (i = pairwise_keys_start;
 883                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 884                      i++) {
 885                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 886                         if (!dev->key[i].keyconf) {
 887                                 /* found empty */
 888                                 index = i;
 889                                 break;
 890                         }
 891                 }
 892                 if (index < 0) {
 893                         b43warn(dev->wl, "Out of hardware key memory\n");
 894                         return -ENOSPC;
 895                 }
 896         } else
 897                 B43_WARN_ON(index > 3);
 898
 899         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 900         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 901                 /* Default RX key */
 902                 B43_WARN_ON(mac_addr);
 903                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 904         }
 905         keyconf->hw_key_idx = index;
 906         dev->key[index].keyconf = keyconf;
 907
 908         return 0;
 909 }
 910
 911 static int b43_key_clear(struct b43_wldev *dev, int index)
 912 {
 913         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 914                 return -EINVAL;
 915         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 916                      NULL, B43_SEC_KEYSIZE, NULL);
 917         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 918                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 919                              NULL, B43_SEC_KEYSIZE, NULL);
 920         }
 921         dev->key[index].keyconf = NULL;
 922
 923         return 0;
 924 }
 925
 926 static void b43_clear_keys(struct b43_wldev *dev)
 927 {
 928         int i, count;
 929
 930         if (b43_new_kidx_api(dev))
 931                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 932         else
 933                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 934         for (i = 0; i < count; i++)
 935                 b43_key_clear(dev, i);
 936 }
 937
 938 static void b43_dump_keymemory(struct b43_wldev *dev)
 939 {
 940         unsigned int i, index, count, offset, pairwise_keys_start;
 941         u8 mac[ETH_ALEN];
 942         u16 algo;
 943         u32 rcmta0;
 944         u16 rcmta1;
 945         u64 hf;
 946         struct b43_key *key;
 947
 948         if (!b43_debug(dev, B43_DBG_KEYS))
 949                 return;
 950
 951         hf = b43_hf_read(dev);
 952         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 953                !!(hf & B43_HF_USEDEFKEYS));
 954         if (b43_new_kidx_api(dev)) {
 955                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 956                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 957         } else {
 958                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 959                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 960         }
 961         for (index = 0; index < count; index++) {
 962                 key = &(dev->key[index]);
 963                 printk(KERN_DEBUG "Key slot %02u: %s",
 964                        index, (key->keyconf == NULL) ? " " : "*");
 965                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 966                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 967                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 968                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 969                 }
 970
 971                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 972                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 973                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 974
 975                 if (index >= pairwise_keys_start) {
 976                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 977                                                 ((index - pairwise_keys_start) * 2) + 0);
 978                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 979                                                 ((index - pairwise_keys_start) * 2) + 1);
 980                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 981                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 982                         printk("   MAC: %pM", mac);
 983                 } else
 984                         printk("   DEFAULT KEY");
 985                 printk("\n");
 986         }
 987 }
 988
 989 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 990 {
 991         u32 macctl;
 992         u16 ucstat;
 993         bool hwps;
 994         bool awake;
 995         int i;
 996
 997         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 998                     (ps_flags & B43_PS_DISABLED));
 999         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1000
1001         if (ps_flags & B43_PS_ENABLED) {
1002                 hwps = 1;
1003         } else if (ps_flags & B43_PS_DISABLED) {
1004                 hwps = 0;
1005         } else {
1006                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1007                 //      and thus is not an AP and we are associated, set bit 25
1008         }
1009         if (ps_flags & B43_PS_AWAKE) {
1010                 awake = 1;
1011         } else if (ps_flags & B43_PS_ASLEEP) {
1012                 awake = 0;
1013         } else {
1014                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1015                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1016                 //      successful, set bit26
1017         }
1018
1019 /* FIXME: For now we force awake-on and hwps-off */
1020         hwps = 0;
1021         awake = 1;
1022
1023         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1024         if (hwps)
1025                 macctl |= B43_MACCTL_HWPS;
1026         else
1027                 macctl &= ~B43_MACCTL_HWPS;
1028         if (awake)
1029                 macctl |= B43_MACCTL_AWAKE;
1030         else
1031                 macctl &= ~B43_MACCTL_AWAKE;
1032         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1033         /* Commit write */
1034         b43_read32(dev, B43_MMIO_MACCTL);
1035         if (awake && dev->dev->id.revision >= 5) {
1036                 /* Wait for the microcode to wake up. */
1037                 for (i = 0; i < 100; i++) {
1038                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                                 B43_SHM_SH_UCODESTAT);
1040                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1041                                 break;
1042                         udelay(10);
1043                 }
1044         }
1045 }
1046
1047 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1048 {
1049         u32 tmslow;
1050         u32 macctl;
1051
1052         flags |= B43_TMSLOW_PHYCLKEN;
1053         flags |= B43_TMSLOW_PHYRESET;
1054         ssb_device_enable(dev->dev, flags);
1055         msleep(2);              /* Wait for the PLL to turn on. */
1056
1057         /* Now take the PHY out of Reset again */
1058         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1059         tmslow |= SSB_TMSLOW_FGC;
1060         tmslow &= ~B43_TMSLOW_PHYRESET;
1061         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1062         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1063         msleep(1);
1064         tmslow &= ~SSB_TMSLOW_FGC;
1065         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1066         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1067         msleep(1);
1068
1069         /* Turn Analog ON, but only if we already know the PHY-type.
1070          * This protects against very early setup where we don't know the
1071          * PHY-type, yet. wireless_core_reset will be called once again later,
1072          * when we know the PHY-type. */
1073         if (dev->phy.ops)
1074                 dev->phy.ops->switch_analog(dev, 1);
1075
1076         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1077         macctl &= ~B43_MACCTL_GMODE;
1078         if (flags & B43_TMSLOW_GMODE)
1079                 macctl |= B43_MACCTL_GMODE;
1080         macctl |= B43_MACCTL_IHR_ENABLED;
1081         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1082 }
1083
1084 static void handle_irq_transmit_status(struct b43_wldev *dev)
1085 {
1086         u32 v0, v1;
1087         u16 tmp;
1088         struct b43_txstatus stat;
1089
1090         while (1) {
1091                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1092                 if (!(v0 & 0x00000001))
1093                         break;
1094                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1095
1096                 stat.cookie = (v0 >> 16);
1097                 stat.seq = (v1 & 0x0000FFFF);
1098                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1099                 tmp = (v0 & 0x0000FFFF);
1100                 stat.frame_count = ((tmp & 0xF000) >> 12);
1101                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1102                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1103                 stat.pm_indicated = !!(tmp & 0x0080);
1104                 stat.intermediate = !!(tmp & 0x0040);
1105                 stat.for_ampdu = !!(tmp & 0x0020);
1106                 stat.acked = !!(tmp & 0x0002);
1107
1108                 b43_handle_txstatus(dev, &stat);
1109         }
1110 }
1111
1112 static void drain_txstatus_queue(struct b43_wldev *dev)
1113 {
1114         u32 dummy;
1115
1116         if (dev->dev->id.revision < 5)
1117                 return;
1118         /* Read all entries from the microcode TXstatus FIFO
1119          * and throw them away.
1120          */
1121         while (1) {
1122                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1123                 if (!(dummy & 0x00000001))
1124                         break;
1125                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1126         }
1127 }
1128
1129 static u32 b43_jssi_read(struct b43_wldev *dev)
1130 {
1131         u32 val = 0;
1132
1133         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1134         val <<= 16;
1135         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1136
1137         return val;
1138 }
1139
1140 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1141 {
1142         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1143         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1144 }
1145
1146 static void b43_generate_noise_sample(struct b43_wldev *dev)
1147 {
1148         b43_jssi_write(dev, 0x7F7F7F7F);
1149         b43_write32(dev, B43_MMIO_MACCMD,
1150                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1151 }
1152
1153 static void b43_calculate_link_quality(struct b43_wldev *dev)
1154 {
1155         /* Top half of Link Quality calculation. */
1156
1157         if (dev->phy.type != B43_PHYTYPE_G)
1158                 return;
1159         if (dev->noisecalc.calculation_running)
1160                 return;
1161         dev->noisecalc.calculation_running = 1;
1162         dev->noisecalc.nr_samples = 0;
1163
1164         b43_generate_noise_sample(dev);
1165 }
1166
1167 static void handle_irq_noise(struct b43_wldev *dev)
1168 {
1169         struct b43_phy_g *phy = dev->phy.g;
1170         u16 tmp;
1171         u8 noise[4];
1172         u8 i, j;
1173         s32 average;
1174
1175         /* Bottom half of Link Quality calculation. */
1176
1177         if (dev->phy.type != B43_PHYTYPE_G)
1178                 return;
1179
1180         /* Possible race condition: It might be possible that the user
1181          * changed to a different channel in the meantime since we
1182          * started the calculation. We ignore that fact, since it's
1183          * not really that much of a problem. The background noise is
1184          * an estimation only anyway. Slightly wrong results will get damped
1185          * by the averaging of the 8 sample rounds. Additionally the
1186          * value is shortlived. So it will be replaced by the next noise
1187          * calculation round soon. */
1188
1189         B43_WARN_ON(!dev->noisecalc.calculation_running);
1190         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1191         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1192             noise[2] == 0x7F || noise[3] == 0x7F)
1193                 goto generate_new;
1194
1195         /* Get the noise samples. */
1196         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1197         i = dev->noisecalc.nr_samples;
1198         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1199         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1200         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1203         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1204         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1205         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1206         dev->noisecalc.nr_samples++;
1207         if (dev->noisecalc.nr_samples == 8) {
1208                 /* Calculate the Link Quality by the noise samples. */
1209                 average = 0;
1210                 for (i = 0; i < 8; i++) {
1211                         for (j = 0; j < 4; j++)
1212                                 average += dev->noisecalc.samples[i][j];
1213                 }
1214                 average /= (8 * 4);
1215                 average *= 125;
1216                 average += 64;
1217                 average /= 128;
1218                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1219                 tmp = (tmp / 128) & 0x1F;
1220                 if (tmp >= 8)
1221                         average += 2;
1222                 else
1223                         average -= 25;
1224                 if (tmp == 8)
1225                         average -= 72;
1226                 else
1227                         average -= 48;
1228
1229                 dev->stats.link_noise = average;
1230                 dev->noisecalc.calculation_running = 0;
1231                 return;
1232         }
1233 generate_new:
1234         b43_generate_noise_sample(dev);
1235 }
1236
1237 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1238 {
1239         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1240                 ///TODO: PS TBTT
1241         } else {
1242                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1243                         b43_power_saving_ctl_bits(dev, 0);
1244         }
1245         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1246                 dev->dfq_valid = 1;
1247 }
1248
1249 static void handle_irq_atim_end(struct b43_wldev *dev)
1250 {
1251         if (dev->dfq_valid) {
1252                 b43_write32(dev, B43_MMIO_MACCMD,
1253                             b43_read32(dev, B43_MMIO_MACCMD)
1254                             | B43_MACCMD_DFQ_VALID);
1255                 dev->dfq_valid = 0;
1256         }
1257 }
1258
1259 static void handle_irq_pmq(struct b43_wldev *dev)
1260 {
1261         u32 tmp;
1262
1263         //TODO: AP mode.
1264
1265         while (1) {
1266                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1267                 if (!(tmp & 0x00000008))
1268                         break;
1269         }
1270         /* 16bit write is odd, but correct. */
1271         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1272 }
1273
1274 static void b43_write_template_common(struct b43_wldev *dev,
1275                                       const u8 *data, u16 size,
1276                                       u16 ram_offset,
1277                                       u16 shm_size_offset, u8 rate)
1278 {
1279         u32 i, tmp;
1280         struct b43_plcp_hdr4 plcp;
1281
1282         plcp.data = 0;
1283         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1284         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1285         ram_offset += sizeof(u32);
1286         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1287          * So leave the first two bytes of the next write blank.
1288          */
1289         tmp = (u32) (data[0]) << 16;
1290         tmp |= (u32) (data[1]) << 24;
1291         b43_ram_write(dev, ram_offset, tmp);
1292         ram_offset += sizeof(u32);
1293         for (i = 2; i < size; i += sizeof(u32)) {
1294                 tmp = (u32) (data[i + 0]);
1295                 if (i + 1 < size)
1296                         tmp |= (u32) (data[i + 1]) << 8;
1297                 if (i + 2 < size)
1298                         tmp |= (u32) (data[i + 2]) << 16;
1299                 if (i + 3 < size)
1300                         tmp |= (u32) (data[i + 3]) << 24;
1301                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1302         }
1303         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1304                         size + sizeof(struct b43_plcp_hdr6));
1305 }
1306
1307 /* Check if the use of the antenna that ieee80211 told us to
1308  * use is possible. This will fall back to DEFAULT.
1309  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1310 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1311                                   u8 antenna_nr)
1312 {
1313         u8 antenna_mask;
1314
1315         if (antenna_nr == 0) {
1316                 /* Zero means "use default antenna". That's always OK. */
1317                 return 0;
1318         }
1319
1320         /* Get the mask of available antennas. */
1321         if (dev->phy.gmode)
1322                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1323         else
1324                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1325
1326         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1327                 /* This antenna is not available. Fall back to default. */
1328                 return 0;
1329         }
1330
1331         return antenna_nr;
1332 }
1333
1334 /* Convert a b43 antenna number value to the PHY TX control value. */
1335 static u16 b43_antenna_to_phyctl(int antenna)
1336 {
1337         switch (antenna) {
1338         case B43_ANTENNA0:
1339                 return B43_TXH_PHY_ANT0;
1340         case B43_ANTENNA1:
1341                 return B43_TXH_PHY_ANT1;
1342         case B43_ANTENNA2:
1343                 return B43_TXH_PHY_ANT2;
1344         case B43_ANTENNA3:
1345                 return B43_TXH_PHY_ANT3;
1346         case B43_ANTENNA_AUTO:
1347                 return B43_TXH_PHY_ANT01AUTO;
1348         }
1349         B43_WARN_ON(1);
1350         return 0;
1351 }
1352
1353 static void b43_write_beacon_template(struct b43_wldev *dev,
1354                                       u16 ram_offset,
1355                                       u16 shm_size_offset)
1356 {
1357         unsigned int i, len, variable_len;
1358         const struct ieee80211_mgmt *bcn;
1359         const u8 *ie;
1360         bool tim_found = 0;
1361         unsigned int rate;
1362         u16 ctl;
1363         int antenna;
1364         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1365
1366         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1367         len = min((size_t) dev->wl->current_beacon->len,
1368                   0x200 - sizeof(struct b43_plcp_hdr6));
1369         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1370
1371         b43_write_template_common(dev, (const u8 *)bcn,
1372                                   len, ram_offset, shm_size_offset, rate);
1373
1374         /* Write the PHY TX control parameters. */
1375         antenna = B43_ANTENNA_DEFAULT;
1376         antenna = b43_antenna_to_phyctl(antenna);
1377         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1378         /* We can't send beacons with short preamble. Would get PHY errors. */
1379         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1380         ctl &= ~B43_TXH_PHY_ANT;
1381         ctl &= ~B43_TXH_PHY_ENC;
1382         ctl |= antenna;
1383         if (b43_is_cck_rate(rate))
1384                 ctl |= B43_TXH_PHY_ENC_CCK;
1385         else
1386                 ctl |= B43_TXH_PHY_ENC_OFDM;
1387         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1388
1389         /* Find the position of the TIM and the DTIM_period value
1390          * and write them to SHM. */
1391         ie = bcn->u.beacon.variable;
1392         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1393         for (i = 0; i < variable_len - 2; ) {
1394                 uint8_t ie_id, ie_len;
1395
1396                 ie_id = ie[i];
1397                 ie_len = ie[i + 1];
1398                 if (ie_id == 5) {
1399                         u16 tim_position;
1400                         u16 dtim_period;
1401                         /* This is the TIM Information Element */
1402
1403                         /* Check whether the ie_len is in the beacon data range. */
1404                         if (variable_len < ie_len + 2 + i)
1405                                 break;
1406                         /* A valid TIM is at least 4 bytes long. */
1407                         if (ie_len < 4)
1408                                 break;
1409                         tim_found = 1;
1410
1411                         tim_position = sizeof(struct b43_plcp_hdr6);
1412                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1413                         tim_position += i;
1414
1415                         dtim_period = ie[i + 3];
1416
1417                         b43_shm_write16(dev, B43_SHM_SHARED,
1418                                         B43_SHM_SH_TIMBPOS, tim_position);
1419                         b43_shm_write16(dev, B43_SHM_SHARED,
1420                                         B43_SHM_SH_DTIMPER, dtim_period);
1421                         break;
1422                 }
1423                 i += ie_len + 2;
1424         }
1425         if (!tim_found) {
1426                 /*
1427                  * If ucode wants to modify TIM do it behind the beacon, this
1428                  * will happen, for example, when doing mesh networking.
1429                  */
1430                 b43_shm_write16(dev, B43_SHM_SHARED,
1431                                 B43_SHM_SH_TIMBPOS,
1432                                 len + sizeof(struct b43_plcp_hdr6));
1433                 b43_shm_write16(dev, B43_SHM_SHARED,
1434                                 B43_SHM_SH_DTIMPER, 0);
1435         }
1436         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1437 }
1438
1439 static void b43_upload_beacon0(struct b43_wldev *dev)
1440 {
1441         struct b43_wl *wl = dev->wl;
1442
1443         if (wl->beacon0_uploaded)
1444                 return;
1445         b43_write_beacon_template(dev, 0x68, 0x18);
1446         wl->beacon0_uploaded = 1;
1447 }
1448
1449 static void b43_upload_beacon1(struct b43_wldev *dev)
1450 {
1451         struct b43_wl *wl = dev->wl;
1452
1453         if (wl->beacon1_uploaded)
1454                 return;
1455         b43_write_beacon_template(dev, 0x468, 0x1A);
1456         wl->beacon1_uploaded = 1;
1457 }
1458
1459 static void handle_irq_beacon(struct b43_wldev *dev)
1460 {
1461         struct b43_wl *wl = dev->wl;
1462         u32 cmd, beacon0_valid, beacon1_valid;
1463
1464         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1465             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1466                 return;
1467
1468         /* This is the bottom half of the asynchronous beacon update. */
1469
1470         /* Ignore interrupt in the future. */
1471         dev->irq_mask &= ~B43_IRQ_BEACON;
1472
1473         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1474         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1475         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1476
1477         /* Schedule interrupt manually, if busy. */
1478         if (beacon0_valid && beacon1_valid) {
1479                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1480                 dev->irq_mask |= B43_IRQ_BEACON;
1481                 return;
1482         }
1483
1484         if (unlikely(wl->beacon_templates_virgin)) {
1485                 /* We never uploaded a beacon before.
1486                  * Upload both templates now, but only mark one valid. */
1487                 wl->beacon_templates_virgin = 0;
1488                 b43_upload_beacon0(dev);
1489                 b43_upload_beacon1(dev);
1490                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1491                 cmd |= B43_MACCMD_BEACON0_VALID;
1492                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1493         } else {
1494                 if (!beacon0_valid) {
1495                         b43_upload_beacon0(dev);
1496                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1497                         cmd |= B43_MACCMD_BEACON0_VALID;
1498                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1499                 } else if (!beacon1_valid) {
1500                         b43_upload_beacon1(dev);
1501                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1502                         cmd |= B43_MACCMD_BEACON1_VALID;
1503                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1504                 }
1505         }
1506 }
1507
1508 static void b43_beacon_update_trigger_work(struct work_struct *work)
1509 {
1510         struct b43_wl *wl = container_of(work, struct b43_wl,
1511                                          beacon_update_trigger);
1512         struct b43_wldev *dev;
1513
1514         mutex_lock(&wl->mutex);
1515         dev = wl->current_dev;
1516         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1517                 spin_lock_irq(&wl->irq_lock);
1518                 /* update beacon right away or defer to irq */
1519                 handle_irq_beacon(dev);
1520                 /* The handler might have updated the IRQ mask. */
1521                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1522                 mmiowb();
1523                 spin_unlock_irq(&wl->irq_lock);
1524         }
1525         mutex_unlock(&wl->mutex);
1526 }
1527
1528 /* Asynchronously update the packet templates in template RAM.
1529  * Locking: Requires wl->irq_lock to be locked. */
1530 static void b43_update_templates(struct b43_wl *wl)
1531 {
1532         struct sk_buff *beacon;
1533
1534         /* This is the top half of the ansynchronous beacon update.
1535          * The bottom half is the beacon IRQ.
1536          * Beacon update must be asynchronous to avoid sending an
1537          * invalid beacon. This can happen for example, if the firmware
1538          * transmits a beacon while we are updating it. */
1539
1540         /* We could modify the existing beacon and set the aid bit in
1541          * the TIM field, but that would probably require resizing and
1542          * moving of data within the beacon template.
1543          * Simply request a new beacon and let mac80211 do the hard work. */
1544         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1545         if (unlikely(!beacon))
1546                 return;
1547
1548         if (wl->current_beacon)
1549                 dev_kfree_skb_any(wl->current_beacon);
1550         wl->current_beacon = beacon;
1551         wl->beacon0_uploaded = 0;
1552         wl->beacon1_uploaded = 0;
1553         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1554 }
1555
1556 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1557 {
1558         b43_time_lock(dev);
1559         if (dev->dev->id.revision >= 3) {
1560                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1561                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1562         } else {
1563                 b43_write16(dev, 0x606, (beacon_int >> 6));
1564                 b43_write16(dev, 0x610, beacon_int);
1565         }
1566         b43_time_unlock(dev);
1567         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1568 }
1569
1570 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1571 {
1572         u16 reason;
1573
1574         /* Read the register that contains the reason code for the panic. */
1575         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1576         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1577
1578         switch (reason) {
1579         default:
1580                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1581                 /* fallthrough */
1582         case B43_FWPANIC_DIE:
1583                 /* Do not restart the controller or firmware.
1584                  * The device is nonfunctional from now on.
1585                  * Restarting would result in this panic to trigger again,
1586                  * so we avoid that recursion. */
1587                 break;
1588         case B43_FWPANIC_RESTART:
1589                 b43_controller_restart(dev, "Microcode panic");
1590                 break;
1591         }
1592 }
1593
1594 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1595 {
1596         unsigned int i, cnt;
1597         u16 reason, marker_id, marker_line;
1598         __le16 *buf;
1599
1600         /* The proprietary firmware doesn't have this IRQ. */
1601         if (!dev->fw.opensource)
1602                 return;
1603
1604         /* Read the register that contains the reason code for this IRQ. */
1605         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1606
1607         switch (reason) {
1608         case B43_DEBUGIRQ_PANIC:
1609                 b43_handle_firmware_panic(dev);
1610                 break;
1611         case B43_DEBUGIRQ_DUMP_SHM:
1612                 if (!B43_DEBUG)
1613                         break; /* Only with driver debugging enabled. */
1614                 buf = kmalloc(4096, GFP_ATOMIC);
1615                 if (!buf) {
1616                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1617                         goto out;
1618                 }
1619                 for (i = 0; i < 4096; i += 2) {
1620                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1621                         buf[i / 2] = cpu_to_le16(tmp);
1622                 }
1623                 b43info(dev->wl, "Shared memory dump:\n");
1624                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1625                                16, 2, buf, 4096, 1);
1626                 kfree(buf);
1627                 break;
1628         case B43_DEBUGIRQ_DUMP_REGS:
1629                 if (!B43_DEBUG)
1630                         break; /* Only with driver debugging enabled. */
1631                 b43info(dev->wl, "Microcode register dump:\n");
1632                 for (i = 0, cnt = 0; i < 64; i++) {
1633                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1634                         if (cnt == 0)
1635                                 printk(KERN_INFO);
1636                         printk("r%02u: 0x%04X  ", i, tmp);
1637                         cnt++;
1638                         if (cnt == 6) {
1639                                 printk("\n");
1640                                 cnt = 0;
1641                         }
1642                 }
1643                 printk("\n");
1644                 break;
1645         case B43_DEBUGIRQ_MARKER:
1646                 if (!B43_DEBUG)
1647                         break; /* Only with driver debugging enabled. */
1648                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1649                                            B43_MARKER_ID_REG);
1650                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1651                                              B43_MARKER_LINE_REG);
1652                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1653                         "at line number %u\n",
1654                         marker_id, marker_line);
1655                 break;
1656         default:
1657                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1658                        reason);
1659         }
1660 out:
1661         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1662         b43_shm_write16(dev, B43_SHM_SCRATCH,
1663                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1664 }
1665
1666 /* Interrupt handler bottom-half */
1667 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1668 {
1669         u32 reason;
1670         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1671         u32 merged_dma_reason = 0;
1672         int i;
1673         unsigned long flags;
1674
1675         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1676
1677         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1678
1679         reason = dev->irq_reason;
1680         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1681                 dma_reason[i] = dev->dma_reason[i];
1682                 merged_dma_reason |= dma_reason[i];
1683         }
1684
1685         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1686                 b43err(dev->wl, "MAC transmission error\n");
1687
1688         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1689                 b43err(dev->wl, "PHY transmission error\n");
1690                 rmb();
1691                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1692                         atomic_set(&dev->phy.txerr_cnt,
1693                                    B43_PHY_TX_BADNESS_LIMIT);
1694                         b43err(dev->wl, "Too many PHY TX errors, "
1695                                         "restarting the controller\n");
1696                         b43_controller_restart(dev, "PHY TX errors");
1697                 }
1698         }
1699
1700         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1701                                           B43_DMAIRQ_NONFATALMASK))) {
1702                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1703                         b43err(dev->wl, "Fatal DMA error: "
1704                                "0x%08X, 0x%08X, 0x%08X, "
1705                                "0x%08X, 0x%08X, 0x%08X\n",
1706                                dma_reason[0], dma_reason[1],
1707                                dma_reason[2], dma_reason[3],
1708                                dma_reason[4], dma_reason[5]);
1709                         b43_controller_restart(dev, "DMA error");
1710                         mmiowb();
1711                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1712                         return;
1713                 }
1714                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1715                         b43err(dev->wl, "DMA error: "
1716                                "0x%08X, 0x%08X, 0x%08X, "
1717                                "0x%08X, 0x%08X, 0x%08X\n",
1718                                dma_reason[0], dma_reason[1],
1719                                dma_reason[2], dma_reason[3],
1720                                dma_reason[4], dma_reason[5]);
1721                 }
1722         }
1723
1724         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1725                 handle_irq_ucode_debug(dev);
1726         if (reason & B43_IRQ_TBTT_INDI)
1727                 handle_irq_tbtt_indication(dev);
1728         if (reason & B43_IRQ_ATIM_END)
1729                 handle_irq_atim_end(dev);
1730         if (reason & B43_IRQ_BEACON)
1731                 handle_irq_beacon(dev);
1732         if (reason & B43_IRQ_PMQ)
1733                 handle_irq_pmq(dev);
1734         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1735                 ;/* TODO */
1736         if (reason & B43_IRQ_NOISESAMPLE_OK)
1737                 handle_irq_noise(dev);
1738
1739         /* Check the DMA reason registers for received data. */
1740         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1741                 if (b43_using_pio_transfers(dev))
1742                         b43_pio_rx(dev->pio.rx_queue);
1743                 else
1744                         b43_dma_rx(dev->dma.rx_ring);
1745         }
1746         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1747         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1748         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1749         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1750         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1751
1752         if (reason & B43_IRQ_TX_OK)
1753                 handle_irq_transmit_status(dev);
1754
1755         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1756         mmiowb();
1757         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1758 }
1759
1760 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1761 {
1762         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1763
1764         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1765         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1766         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1767         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1768         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1769 /* Unused ring
1770         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1771 */
1772 }
1773
1774 /* Interrupt handler top-half */
1775 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1776 {
1777         irqreturn_t ret = IRQ_NONE;
1778         struct b43_wldev *dev = dev_id;
1779         u32 reason;
1780
1781         B43_WARN_ON(!dev);
1782
1783         spin_lock(&dev->wl->irq_lock);
1784
1785         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1786                 /* This can only happen on shared IRQ lines. */
1787                 goto out;
1788         }
1789         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1790         if (reason == 0xffffffff)       /* shared IRQ */
1791                 goto out;
1792         ret = IRQ_HANDLED;
1793         reason &= dev->irq_mask;
1794         if (!reason)
1795                 goto out;
1796
1797         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1798             & 0x0001DC00;
1799         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1800             & 0x0000DC00;
1801         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1802             & 0x0000DC00;
1803         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1804             & 0x0001DC00;
1805         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1806             & 0x0000DC00;
1807 /* Unused ring
1808         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1809             & 0x0000DC00;
1810 */
1811
1812         b43_interrupt_ack(dev, reason);
1813         /* disable all IRQs. They are enabled again in the bottom half. */
1814         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1815         /* save the reason code and call our bottom half. */
1816         dev->irq_reason = reason;
1817         tasklet_schedule(&dev->isr_tasklet);
1818 out:
1819         mmiowb();
1820         spin_unlock(&dev->wl->irq_lock);
1821
1822         return ret;
1823 }
1824
1825 void b43_do_release_fw(struct b43_firmware_file *fw)
1826 {
1827         release_firmware(fw->data);
1828         fw->data = NULL;
1829         fw->filename = NULL;
1830 }
1831
1832 static void b43_release_firmware(struct b43_wldev *dev)
1833 {
1834         b43_do_release_fw(&dev->fw.ucode);
1835         b43_do_release_fw(&dev->fw.pcm);
1836         b43_do_release_fw(&dev->fw.initvals);
1837         b43_do_release_fw(&dev->fw.initvals_band);
1838 }
1839
1840 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1841 {
1842         const char text[] =
1843                 "You must go to " \
1844                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1845                 "and download the correct firmware for this driver version. " \
1846                 "Please carefully read all instructions on this website.\n";
1847
1848         if (error)
1849                 b43err(wl, text);
1850         else
1851                 b43warn(wl, text);
1852 }
1853
1854 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1855                       const char *name,
1856                       struct b43_firmware_file *fw)
1857 {
1858         const struct firmware *blob;
1859         struct b43_fw_header *hdr;
1860         u32 size;
1861         int err;
1862
1863         if (!name) {
1864                 /* Don't fetch anything. Free possibly cached firmware. */
1865                 /* FIXME: We should probably keep it anyway, to save some headache
1866                  * on suspend/resume with multiband devices. */
1867                 b43_do_release_fw(fw);
1868                 return 0;
1869         }
1870         if (fw->filename) {
1871                 if ((fw->type == ctx->req_type) &&
1872                     (strcmp(fw->filename, name) == 0))
1873                         return 0; /* Already have this fw. */
1874                 /* Free the cached firmware first. */
1875                 /* FIXME: We should probably do this later after we successfully
1876                  * got the new fw. This could reduce headache with multiband devices.
1877                  * We could also redesign this to cache the firmware for all possible
1878                  * bands all the time. */
1879                 b43_do_release_fw(fw);
1880         }
1881
1882         switch (ctx->req_type) {
1883         case B43_FWTYPE_PROPRIETARY:
1884                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1885                          "b43%s/%s.fw",
1886                          modparam_fwpostfix, name);
1887                 break;
1888         case B43_FWTYPE_OPENSOURCE:
1889                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1890                          "b43-open%s/%s.fw",
1891                          modparam_fwpostfix, name);
1892                 break;
1893         default:
1894                 B43_WARN_ON(1);
1895                 return -ENOSYS;
1896         }
1897         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
1898         if (err == -ENOENT) {
1899                 snprintf(ctx->errors[ctx->req_type],
1900                          sizeof(ctx->errors[ctx->req_type]),
1901                          "Firmware file \"%s\" not found\n", ctx->fwname);
1902                 return err;
1903         } else if (err) {
1904                 snprintf(ctx->errors[ctx->req_type],
1905                          sizeof(ctx->errors[ctx->req_type]),
1906                          "Firmware file \"%s\" request failed (err=%d)\n",
1907                          ctx->fwname, err);
1908                 return err;
1909         }
1910         if (blob->size < sizeof(struct b43_fw_header))
1911                 goto err_format;
1912         hdr = (struct b43_fw_header *)(blob->data);
1913         switch (hdr->type) {
1914         case B43_FW_TYPE_UCODE:
1915         case B43_FW_TYPE_PCM:
1916                 size = be32_to_cpu(hdr->size);
1917                 if (size != blob->size - sizeof(struct b43_fw_header))
1918                         goto err_format;
1919                 /* fallthrough */
1920         case B43_FW_TYPE_IV:
1921                 if (hdr->ver != 1)
1922                         goto err_format;
1923                 break;
1924         default:
1925                 goto err_format;
1926         }
1927
1928         fw->data = blob;
1929         fw->filename = name;
1930         fw->type = ctx->req_type;
1931
1932         return 0;
1933
1934 err_format:
1935         snprintf(ctx->errors[ctx->req_type],
1936                  sizeof(ctx->errors[ctx->req_type]),
1937                  "Firmware file \"%s\" format error.\n", ctx->fwname);
1938         release_firmware(blob);
1939
1940         return -EPROTO;
1941 }
1942
1943 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
1944 {
1945         struct b43_wldev *dev = ctx->dev;
1946         struct b43_firmware *fw = &ctx->dev->fw;
1947         const u8 rev = ctx->dev->dev->id.revision;
1948         const char *filename;
1949         u32 tmshigh;
1950         int err;
1951
1952         /* Get microcode */
1953         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1954         if ((rev >= 5) && (rev <= 10))
1955                 filename = "ucode5";
1956         else if ((rev >= 11) && (rev <= 12))
1957                 filename = "ucode11";
1958         else if (rev == 13)
1959                 filename = "ucode13";
1960         else if (rev == 14)
1961                 filename = "ucode14";
1962         else if (rev >= 15)
1963                 filename = "ucode15";
1964         else
1965                 goto err_no_ucode;
1966         err = b43_do_request_fw(ctx, filename, &fw->ucode);
1967         if (err)
1968                 goto err_load;
1969
1970         /* Get PCM code */
1971         if ((rev >= 5) && (rev <= 10))
1972                 filename = "pcm5";
1973         else if (rev >= 11)
1974                 filename = NULL;
1975         else
1976                 goto err_no_pcm;
1977         fw->pcm_request_failed = 0;
1978         err = b43_do_request_fw(ctx, filename, &fw->pcm);
1979         if (err == -ENOENT) {
1980                 /* We did not find a PCM file? Not fatal, but
1981                  * core rev <= 10 must do without hwcrypto then. */
1982                 fw->pcm_request_failed = 1;
1983         } else if (err)
1984                 goto err_load;
1985
1986         /* Get initvals */
1987         switch (dev->phy.type) {
1988         case B43_PHYTYPE_A:
1989                 if ((rev >= 5) && (rev <= 10)) {
1990                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1991                                 filename = "a0g1initvals5";
1992                         else
1993                                 filename = "a0g0initvals5";
1994                 } else
1995                         goto err_no_initvals;
1996                 break;
1997         case B43_PHYTYPE_G:
1998                 if ((rev >= 5) && (rev <= 10))
1999                         filename = "b0g0initvals5";
2000                 else if (rev >= 13)
2001                         filename = "b0g0initvals13";
2002                 else
2003                         goto err_no_initvals;
2004                 break;
2005         case B43_PHYTYPE_N:
2006                 if ((rev >= 11) && (rev <= 12))
2007                         filename = "n0initvals11";
2008                 else
2009                         goto err_no_initvals;
2010                 break;
2011         case B43_PHYTYPE_LP:
2012                 if (rev == 13)
2013                         filename = "lp0initvals13";
2014                 else if (rev == 14)
2015                         filename = "lp0initvals14";
2016                 else if (rev >= 15)
2017                         filename = "lp0initvals15";
2018                 else
2019                         goto err_no_initvals;
2020                 break;
2021         default:
2022                 goto err_no_initvals;
2023         }
2024         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2025         if (err)
2026                 goto err_load;
2027
2028         /* Get bandswitch initvals */
2029         switch (dev->phy.type) {
2030         case B43_PHYTYPE_A:
2031                 if ((rev >= 5) && (rev <= 10)) {
2032                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2033                                 filename = "a0g1bsinitvals5";
2034                         else
2035                                 filename = "a0g0bsinitvals5";
2036                 } else if (rev >= 11)
2037                         filename = NULL;
2038                 else
2039                         goto err_no_initvals;
2040                 break;
2041         case B43_PHYTYPE_G:
2042                 if ((rev >= 5) && (rev <= 10))
2043                         filename = "b0g0bsinitvals5";
2044                 else if (rev >= 11)
2045                         filename = NULL;
2046                 else
2047                         goto err_no_initvals;
2048                 break;
2049         case B43_PHYTYPE_N:
2050                 if ((rev >= 11) && (rev <= 12))
2051                         filename = "n0bsinitvals11";
2052                 else
2053                         goto err_no_initvals;
2054                 break;
2055         case B43_PHYTYPE_LP:
2056                 if (rev == 13)
2057                         filename = "lp0bsinitvals13";
2058                 else if (rev == 14)
2059                         filename = "lp0bsinitvals14";
2060                 else if (rev >= 15)
2061                         filename = "lp0bsinitvals15";
2062                 else
2063                         goto err_no_initvals;
2064                 break;
2065         default:
2066                 goto err_no_initvals;
2067         }
2068         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2069         if (err)
2070                 goto err_load;
2071
2072         return 0;
2073
2074 err_no_ucode:
2075         err = ctx->fatal_failure = -EOPNOTSUPP;
2076         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2077                "is required for your device (wl-core rev %u)\n", rev);
2078         goto error;
2079
2080 err_no_pcm:
2081         err = ctx->fatal_failure = -EOPNOTSUPP;
2082         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2083                "is required for your device (wl-core rev %u)\n", rev);
2084         goto error;
2085
2086 err_no_initvals:
2087         err = ctx->fatal_failure = -EOPNOTSUPP;
2088         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2089                "is required for your device (wl-core rev %u)\n", rev);
2090         goto error;
2091
2092 err_load:
2093         /* We failed to load this firmware image. The error message
2094          * already is in ctx->errors. Return and let our caller decide
2095          * what to do. */
2096         goto error;
2097
2098 error:
2099         b43_release_firmware(dev);
2100         return err;
2101 }
2102
2103 static int b43_request_firmware(struct b43_wldev *dev)
2104 {
2105         struct b43_request_fw_context *ctx;
2106         unsigned int i;
2107         int err;
2108         const char *errmsg;
2109
2110         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2111         if (!ctx)
2112                 return -ENOMEM;
2113         ctx->dev = dev;
2114
2115         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2116         err = b43_try_request_fw(ctx);
2117         if (!err)
2118                 goto out; /* Successfully loaded it. */
2119         err = ctx->fatal_failure;
2120         if (err)
2121                 goto out;
2122
2123         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2124         err = b43_try_request_fw(ctx);
2125         if (!err)
2126                 goto out; /* Successfully loaded it. */
2127         err = ctx->fatal_failure;
2128         if (err)
2129                 goto out;
2130
2131         /* Could not find a usable firmware. Print the errors. */
2132         for (i = 0; i < B43_NR_FWTYPES; i++) {
2133                 errmsg = ctx->errors[i];
2134                 if (strlen(errmsg))
2135                         b43err(dev->wl, errmsg);
2136         }
2137         b43_print_fw_helptext(dev->wl, 1);
2138         err = -ENOENT;
2139
2140 out:
2141         kfree(ctx);
2142         return err;
2143 }
2144
2145 static int b43_upload_microcode(struct b43_wldev *dev)
2146 {
2147         const size_t hdr_len = sizeof(struct b43_fw_header);
2148         const __be32 *data;
2149         unsigned int i, len;
2150         u16 fwrev, fwpatch, fwdate, fwtime;
2151         u32 tmp, macctl;
2152         int err = 0;
2153
2154         /* Jump the microcode PSM to offset 0 */
2155         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2156         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2157         macctl |= B43_MACCTL_PSM_JMP0;
2158         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2159         /* Zero out all microcode PSM registers and shared memory. */
2160         for (i = 0; i < 64; i++)
2161                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2162         for (i = 0; i < 4096; i += 2)
2163                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2164
2165         /* Upload Microcode. */
2166         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2167         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2168         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2169         for (i = 0; i < len; i++) {
2170                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2171                 udelay(10);
2172         }
2173
2174         if (dev->fw.pcm.data) {
2175                 /* Upload PCM data. */
2176                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2177                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2178                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2179                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2180                 /* No need for autoinc bit in SHM_HW */
2181                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2182                 for (i = 0; i < len; i++) {
2183                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2184                         udelay(10);
2185                 }
2186         }
2187
2188         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2189
2190         /* Start the microcode PSM */
2191         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2192         macctl &= ~B43_MACCTL_PSM_JMP0;
2193         macctl |= B43_MACCTL_PSM_RUN;
2194         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2195
2196         /* Wait for the microcode to load and respond */
2197         i = 0;
2198         while (1) {
2199                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2200                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2201                         break;
2202                 i++;
2203                 if (i >= 20) {
2204                         b43err(dev->wl, "Microcode not responding\n");
2205                         b43_print_fw_helptext(dev->wl, 1);
2206                         err = -ENODEV;
2207                         goto error;
2208                 }
2209                 msleep_interruptible(50);
2210                 if (signal_pending(current)) {
2211                         err = -EINTR;
2212                         goto error;
2213                 }
2214         }
2215         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2216
2217         /* Get and check the revisions. */
2218         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2219         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2220         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2221         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2222
2223         if (fwrev <= 0x128) {
2224                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2225                        "binary drivers older than version 4.x is unsupported. "
2226                        "You must upgrade your firmware files.\n");
2227                 b43_print_fw_helptext(dev->wl, 1);
2228                 err = -EOPNOTSUPP;
2229                 goto error;
2230         }
2231         dev->fw.rev = fwrev;
2232         dev->fw.patch = fwpatch;
2233         dev->fw.opensource = (fwdate == 0xFFFF);
2234
2235         /* Default to use-all-queues. */
2236         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2237         dev->qos_enabled = !!modparam_qos;
2238         /* Default to firmware/hardware crypto acceleration. */
2239         dev->hwcrypto_enabled = 1;
2240
2241         if (dev->fw.opensource) {
2242                 u16 fwcapa;
2243
2244                 /* Patchlevel info is encoded in the "time" field. */
2245                 dev->fw.patch = fwtime;
2246                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2247                         dev->fw.rev, dev->fw.patch);
2248
2249                 fwcapa = b43_fwcapa_read(dev);
2250                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2251                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2252                         /* Disable hardware crypto and fall back to software crypto. */
2253                         dev->hwcrypto_enabled = 0;
2254                 }
2255                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2256                         b43info(dev->wl, "QoS not supported by firmware\n");
2257                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2258                          * ieee80211_unregister to make sure the networking core can
2259                          * properly free possible resources. */
2260                         dev->wl->hw->queues = 1;
2261                         dev->qos_enabled = 0;
2262                 }
2263         } else {
2264                 b43info(dev->wl, "Loading firmware version %u.%u "
2265                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2266                         fwrev, fwpatch,
2267                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2268                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2269                 if (dev->fw.pcm_request_failed) {
2270                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2271                                 "Hardware accelerated cryptography is disabled.\n");
2272                         b43_print_fw_helptext(dev->wl, 0);
2273                 }
2274         }
2275
2276         if (b43_is_old_txhdr_format(dev)) {
2277                 /* We're over the deadline, but we keep support for old fw
2278                  * until it turns out to be in major conflict with something new. */
2279                 b43warn(dev->wl, "You are using an old firmware image. "
2280                         "Support for old firmware will be removed soon "
2281                         "(official deadline was July 2008).\n");
2282                 b43_print_fw_helptext(dev->wl, 0);
2283         }
2284
2285         return 0;
2286
2287 error:
2288         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2289         macctl &= ~B43_MACCTL_PSM_RUN;
2290         macctl |= B43_MACCTL_PSM_JMP0;
2291         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2292
2293         return err;
2294 }
2295
2296 static int b43_write_initvals(struct b43_wldev *dev,
2297                               const struct b43_iv *ivals,
2298                               size_t count,
2299                               size_t array_size)
2300 {
2301         const struct b43_iv *iv;
2302         u16 offset;
2303         size_t i;
2304         bool bit32;
2305
2306         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2307         iv = ivals;
2308         for (i = 0; i < count; i++) {
2309                 if (array_size < sizeof(iv->offset_size))
2310                         goto err_format;
2311                 array_size -= sizeof(iv->offset_size);
2312                 offset = be16_to_cpu(iv->offset_size);
2313                 bit32 = !!(offset & B43_IV_32BIT);
2314                 offset &= B43_IV_OFFSET_MASK;
2315                 if (offset >= 0x1000)
2316                         goto err_format;
2317                 if (bit32) {
2318                         u32 value;
2319
2320                         if (array_size < sizeof(iv->data.d32))
2321                                 goto err_format;
2322                         array_size -= sizeof(iv->data.d32);
2323
2324                         value = get_unaligned_be32(&iv->data.d32);
2325                         b43_write32(dev, offset, value);
2326
2327                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2328                                                         sizeof(__be16) +
2329                                                         sizeof(__be32));
2330                 } else {
2331                         u16 value;
2332
2333                         if (array_size < sizeof(iv->data.d16))
2334                                 goto err_format;
2335                         array_size -= sizeof(iv->data.d16);
2336
2337                         value = be16_to_cpu(iv->data.d16);
2338                         b43_write16(dev, offset, value);
2339
2340                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2341                                                         sizeof(__be16) +
2342                                                         sizeof(__be16));
2343                 }
2344         }
2345         if (array_size)
2346                 goto err_format;
2347
2348         return 0;
2349
2350 err_format:
2351         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2352         b43_print_fw_helptext(dev->wl, 1);
2353
2354         return -EPROTO;
2355 }
2356
2357 static int b43_upload_initvals(struct b43_wldev *dev)
2358 {
2359         const size_t hdr_len = sizeof(struct b43_fw_header);
2360         const struct b43_fw_header *hdr;
2361         struct b43_firmware *fw = &dev->fw;
2362         const struct b43_iv *ivals;
2363         size_t count;
2364         int err;
2365
2366         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2367         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2368         count = be32_to_cpu(hdr->size);
2369         err = b43_write_initvals(dev, ivals, count,
2370                                  fw->initvals.data->size - hdr_len);
2371         if (err)
2372                 goto out;
2373         if (fw->initvals_band.data) {
2374                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2375                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2376                 count = be32_to_cpu(hdr->size);
2377                 err = b43_write_initvals(dev, ivals, count,
2378                                          fw->initvals_band.data->size - hdr_len);
2379                 if (err)
2380                         goto out;
2381         }
2382 out:
2383
2384         return err;
2385 }
2386
2387 /* Initialize the GPIOs
2388  * http://bcm-specs.sipsolutions.net/GPIO
2389  */
2390 static int b43_gpio_init(struct b43_wldev *dev)
2391 {
2392         struct ssb_bus *bus = dev->dev->bus;
2393         struct ssb_device *gpiodev, *pcidev = NULL;
2394         u32 mask, set;
2395
2396         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2397                     & ~B43_MACCTL_GPOUTSMSK);
2398
2399         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2400                     | 0x000F);
2401
2402         mask = 0x0000001F;
2403         set = 0x0000000F;
2404         if (dev->dev->bus->chip_id == 0x4301) {
2405                 mask |= 0x0060;
2406                 set |= 0x0060;
2407         }
2408         if (0 /* FIXME: conditional unknown */ ) {
2409                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2410                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2411                             | 0x0100);
2412                 mask |= 0x0180;
2413                 set |= 0x0180;
2414         }
2415         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2416                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2417                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2418                             | 0x0200);
2419                 mask |= 0x0200;
2420                 set |= 0x0200;
2421         }
2422         if (dev->dev->id.revision >= 2)
2423                 mask |= 0x0010; /* FIXME: This is redundant. */
2424
2425 #ifdef CONFIG_SSB_DRIVER_PCICORE
2426         pcidev = bus->pcicore.dev;
2427 #endif
2428         gpiodev = bus->chipco.dev ? : pcidev;
2429         if (!gpiodev)
2430                 return 0;
2431         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2432                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2433                      & mask) | set);
2434
2435         return 0;
2436 }
2437
2438 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2439 static void b43_gpio_cleanup(struct b43_wldev *dev)
2440 {
2441         struct ssb_bus *bus = dev->dev->bus;
2442         struct ssb_device *gpiodev, *pcidev = NULL;
2443
2444 #ifdef CONFIG_SSB_DRIVER_PCICORE
2445         pcidev = bus->pcicore.dev;
2446 #endif
2447         gpiodev = bus->chipco.dev ? : pcidev;
2448         if (!gpiodev)
2449                 return;
2450         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2451 }
2452
2453 /* http://bcm-specs.sipsolutions.net/EnableMac */
2454 void b43_mac_enable(struct b43_wldev *dev)
2455 {
2456         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2457                 u16 fwstate;
2458
2459                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2460                                          B43_SHM_SH_UCODESTAT);
2461                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2462                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2463                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2464                                "should be suspended, but current state is %u\n",
2465                                fwstate);
2466                 }
2467         }
2468
2469         dev->mac_suspended--;
2470         B43_WARN_ON(dev->mac_suspended < 0);
2471         if (dev->mac_suspended == 0) {
2472                 b43_write32(dev, B43_MMIO_MACCTL,
2473                             b43_read32(dev, B43_MMIO_MACCTL)
2474                             | B43_MACCTL_ENABLED);
2475                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2476                             B43_IRQ_MAC_SUSPENDED);
2477                 /* Commit writes */
2478                 b43_read32(dev, B43_MMIO_MACCTL);
2479                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2480                 b43_power_saving_ctl_bits(dev, 0);
2481         }
2482 }
2483
2484 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2485 void b43_mac_suspend(struct b43_wldev *dev)
2486 {
2487         int i;
2488         u32 tmp;
2489
2490         might_sleep();
2491         B43_WARN_ON(dev->mac_suspended < 0);
2492
2493         if (dev->mac_suspended == 0) {
2494                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2495                 b43_write32(dev, B43_MMIO_MACCTL,
2496                             b43_read32(dev, B43_MMIO_MACCTL)
2497                             & ~B43_MACCTL_ENABLED);
2498                 /* force pci to flush the write */
2499                 b43_read32(dev, B43_MMIO_MACCTL);
2500                 for (i = 35; i; i--) {
2501                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2502                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2503                                 goto out;
2504                         udelay(10);
2505                 }
2506                 /* Hm, it seems this will take some time. Use msleep(). */
2507                 for (i = 40; i; i--) {
2508                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2509                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2510                                 goto out;
2511                         msleep(1);
2512                 }
2513                 b43err(dev->wl, "MAC suspend failed\n");
2514         }
2515 out:
2516         dev->mac_suspended++;
2517 }
2518
2519 static void b43_adjust_opmode(struct b43_wldev *dev)
2520 {
2521         struct b43_wl *wl = dev->wl;
2522         u32 ctl;
2523         u16 cfp_pretbtt;
2524
2525         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2526         /* Reset status to STA infrastructure mode. */
2527         ctl &= ~B43_MACCTL_AP;
2528         ctl &= ~B43_MACCTL_KEEP_CTL;
2529         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2530         ctl &= ~B43_MACCTL_KEEP_BAD;
2531         ctl &= ~B43_MACCTL_PROMISC;
2532         ctl &= ~B43_MACCTL_BEACPROMISC;
2533         ctl |= B43_MACCTL_INFRA;
2534
2535         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2536             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2537                 ctl |= B43_MACCTL_AP;
2538         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2539                 ctl &= ~B43_MACCTL_INFRA;
2540
2541         if (wl->filter_flags & FIF_CONTROL)
2542                 ctl |= B43_MACCTL_KEEP_CTL;
2543         if (wl->filter_flags & FIF_FCSFAIL)
2544                 ctl |= B43_MACCTL_KEEP_BAD;
2545         if (wl->filter_flags & FIF_PLCPFAIL)
2546                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2547         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2548                 ctl |= B43_MACCTL_PROMISC;
2549         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2550                 ctl |= B43_MACCTL_BEACPROMISC;
2551
2552         /* Workaround: On old hardware the HW-MAC-address-filter
2553          * doesn't work properly, so always run promisc in filter
2554          * it in software. */
2555         if (dev->dev->id.revision <= 4)
2556                 ctl |= B43_MACCTL_PROMISC;
2557
2558         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2559
2560         cfp_pretbtt = 2;
2561         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2562                 if (dev->dev->bus->chip_id == 0x4306 &&
2563                     dev->dev->bus->chip_rev == 3)
2564                         cfp_pretbtt = 100;
2565                 else
2566                         cfp_pretbtt = 50;
2567         }
2568         b43_write16(dev, 0x612, cfp_pretbtt);
2569 }
2570
2571 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2572 {
2573         u16 offset;
2574
2575         if (is_ofdm) {
2576                 offset = 0x480;
2577                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2578         } else {
2579                 offset = 0x4C0;
2580                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2581         }
2582         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2583                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2584 }
2585
2586 static void b43_rate_memory_init(struct b43_wldev *dev)
2587 {
2588         switch (dev->phy.type) {
2589         case B43_PHYTYPE_A:
2590         case B43_PHYTYPE_G:
2591         case B43_PHYTYPE_N:
2592         case B43_PHYTYPE_LP:
2593                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2594                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2595                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2596                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2597                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2598                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2599                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2600                 if (dev->phy.type == B43_PHYTYPE_A)
2601                         break;
2602                 /* fallthrough */
2603         case B43_PHYTYPE_B:
2604                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2605                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2606                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2607                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2608                 break;
2609         default:
2610                 B43_WARN_ON(1);
2611         }
2612 }
2613
2614 /* Set the default values for the PHY TX Control Words. */
2615 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2616 {
2617         u16 ctl = 0;
2618
2619         ctl |= B43_TXH_PHY_ENC_CCK;
2620         ctl |= B43_TXH_PHY_ANT01AUTO;
2621         ctl |= B43_TXH_PHY_TXPWR;
2622
2623         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2624         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2625         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2626 }
2627
2628 /* Set the TX-Antenna for management frames sent by firmware. */
2629 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2630 {
2631         u16 ant;
2632         u16 tmp;
2633
2634         ant = b43_antenna_to_phyctl(antenna);
2635
2636         /* For ACK/CTS */
2637         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2638         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2639         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2640         /* For Probe Resposes */
2641         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2642         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2643         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2644 }
2645
2646 /* This is the opposite of b43_chip_init() */
2647 static void b43_chip_exit(struct b43_wldev *dev)
2648 {
2649         b43_phy_exit(dev);
2650         b43_gpio_cleanup(dev);
2651         /* firmware is released later */
2652 }
2653
2654 /* Initialize the chip
2655  * http://bcm-specs.sipsolutions.net/ChipInit
2656  */
2657 static int b43_chip_init(struct b43_wldev *dev)
2658 {
2659         struct b43_phy *phy = &dev->phy;
2660         int err;
2661         u32 value32, macctl;
2662         u16 value16;
2663
2664         /* Initialize the MAC control */
2665         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2666         if (dev->phy.gmode)
2667                 macctl |= B43_MACCTL_GMODE;
2668         macctl |= B43_MACCTL_INFRA;
2669         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2670
2671         err = b43_request_firmware(dev);
2672         if (err)
2673                 goto out;
2674         err = b43_upload_microcode(dev);
2675         if (err)
2676                 goto out;       /* firmware is released later */
2677
2678         err = b43_gpio_init(dev);
2679         if (err)
2680                 goto out;       /* firmware is released later */
2681
2682         err = b43_upload_initvals(dev);
2683         if (err)
2684                 goto err_gpio_clean;
2685
2686         /* Turn the Analog on and initialize the PHY. */
2687         phy->ops->switch_analog(dev, 1);
2688         err = b43_phy_init(dev);
2689         if (err)
2690                 goto err_gpio_clean;
2691
2692         /* Disable Interference Mitigation. */
2693         if (phy->ops->interf_mitigation)
2694                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2695
2696         /* Select the antennae */
2697         if (phy->ops->set_rx_antenna)
2698                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2699         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2700
2701         if (phy->type == B43_PHYTYPE_B) {
2702                 value16 = b43_read16(dev, 0x005E);
2703                 value16 |= 0x0004;
2704                 b43_write16(dev, 0x005E, value16);
2705         }
2706         b43_write32(dev, 0x0100, 0x01000000);
2707         if (dev->dev->id.revision < 5)
2708                 b43_write32(dev, 0x010C, 0x01000000);
2709
2710         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2711                     & ~B43_MACCTL_INFRA);
2712         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2713                     | B43_MACCTL_INFRA);
2714
2715         /* Probe Response Timeout value */
2716         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2717         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2718
2719         /* Initially set the wireless operation mode. */
2720         b43_adjust_opmode(dev);
2721
2722         if (dev->dev->id.revision < 3) {
2723                 b43_write16(dev, 0x060E, 0x0000);
2724                 b43_write16(dev, 0x0610, 0x8000);
2725                 b43_write16(dev, 0x0604, 0x0000);
2726                 b43_write16(dev, 0x0606, 0x0200);
2727         } else {
2728                 b43_write32(dev, 0x0188, 0x80000000);
2729                 b43_write32(dev, 0x018C, 0x02000000);
2730         }
2731         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2732         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2733         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2734         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2735         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2736         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2737         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2738
2739         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2740         value32 |= 0x00100000;
2741         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2742
2743         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2744                     dev->dev->bus->chipco.fast_pwrup_delay);
2745
2746         err = 0;
2747         b43dbg(dev->wl, "Chip initialized\n");
2748 out:
2749         return err;
2750
2751 err_gpio_clean:
2752         b43_gpio_cleanup(dev);
2753         return err;
2754 }
2755
2756 static void b43_periodic_every60sec(struct b43_wldev *dev)
2757 {
2758         const struct b43_phy_operations *ops = dev->phy.ops;
2759
2760         if (ops->pwork_60sec)
2761                 ops->pwork_60sec(dev);
2762
2763         /* Force check the TX power emission now. */
2764         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2765 }
2766
2767 static void b43_periodic_every30sec(struct b43_wldev *dev)
2768 {
2769         /* Update device statistics. */
2770         b43_calculate_link_quality(dev);
2771 }
2772
2773 static void b43_periodic_every15sec(struct b43_wldev *dev)
2774 {
2775         struct b43_phy *phy = &dev->phy;
2776         u16 wdr;
2777
2778         if (dev->fw.opensource) {
2779                 /* Check if the firmware is still alive.
2780                  * It will reset the watchdog counter to 0 in its idle loop. */
2781                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2782                 if (unlikely(wdr)) {
2783                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2784                         b43_controller_restart(dev, "Firmware watchdog");
2785                         return;
2786                 } else {
2787                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2788                                         B43_WATCHDOG_REG, 1);
2789                 }
2790         }
2791
2792         if (phy->ops->pwork_15sec)
2793                 phy->ops->pwork_15sec(dev);
2794
2795         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2796         wmb();
2797 }
2798
2799 static void do_periodic_work(struct b43_wldev *dev)
2800 {
2801         unsigned int state;
2802
2803         state = dev->periodic_state;
2804         if (state % 4 == 0)
2805                 b43_periodic_every60sec(dev);
2806         if (state % 2 == 0)
2807                 b43_periodic_every30sec(dev);
2808         b43_periodic_every15sec(dev);
2809 }
2810
2811 /* Periodic work locking policy:
2812  *      The whole periodic work handler is protected by
2813  *      wl->mutex. If another lock is needed somewhere in the
2814  *      pwork callchain, it's aquired in-place, where it's needed.
2815  */
2816 static void b43_periodic_work_handler(struct work_struct *work)
2817 {
2818         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2819                                              periodic_work.work);
2820         struct b43_wl *wl = dev->wl;
2821         unsigned long delay;
2822
2823         mutex_lock(&wl->mutex);
2824
2825         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2826                 goto out;
2827         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2828                 goto out_requeue;
2829
2830         do_periodic_work(dev);
2831
2832         dev->periodic_state++;
2833 out_requeue:
2834         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2835                 delay = msecs_to_jiffies(50);
2836         else
2837                 delay = round_jiffies_relative(HZ * 15);
2838         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2839 out:
2840         mutex_unlock(&wl->mutex);
2841 }
2842
2843 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2844 {
2845         struct delayed_work *work = &dev->periodic_work;
2846
2847         dev->periodic_state = 0;
2848         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2849         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2850 }
2851
2852 /* Check if communication with the device works correctly. */
2853 static int b43_validate_chipaccess(struct b43_wldev *dev)
2854 {
2855         u32 v, backup0, backup4;
2856
2857         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2858         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2859
2860         /* Check for read/write and endianness problems. */
2861         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2862         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2863                 goto error;
2864         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2865         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2866                 goto error;
2867
2868         /* Check if unaligned 32bit SHM_SHARED access works properly.
2869          * However, don't bail out on failure, because it's noncritical. */
2870         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2871         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2872         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2873         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2874         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2875                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2876         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2877         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2878             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2879             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2880             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2881                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2882
2883         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2884         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2885
2886         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2887                 /* The 32bit register shadows the two 16bit registers
2888                  * with update sideeffects. Validate this. */
2889                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2890                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2891                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2892                         goto error;
2893                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2894                         goto error;
2895         }
2896         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2897
2898         v = b43_read32(dev, B43_MMIO_MACCTL);
2899         v |= B43_MACCTL_GMODE;
2900         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2901                 goto error;
2902
2903         return 0;
2904 error:
2905         b43err(dev->wl, "Failed to validate the chipaccess\n");
2906         return -ENODEV;
2907 }
2908
2909 static void b43_security_init(struct b43_wldev *dev)
2910 {
2911         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2912         /* KTP is a word address, but we address SHM bytewise.
2913          * So multiply by two.
2914          */
2915         dev->ktp *= 2;
2916         /* Number of RCMTA address slots */
2917         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
2918         /* Clear the key memory. */
2919         b43_clear_keys(dev);
2920 }
2921
2922 #ifdef CONFIG_B43_HWRNG
2923 static int b43_rng_read(struct hwrng *rng, u32 *data)
2924 {
2925         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2926         unsigned long flags;
2927
2928         /* Don't take wl->mutex here, as it could deadlock with
2929          * hwrng internal locking. It's not needed to take
2930          * wl->mutex here, anyway. */
2931
2932         spin_lock_irqsave(&wl->irq_lock, flags);
2933         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2934         spin_unlock_irqrestore(&wl->irq_lock, flags);
2935
2936         return (sizeof(u16));
2937 }
2938 #endif /* CONFIG_B43_HWRNG */
2939
2940 static void b43_rng_exit(struct b43_wl *wl)
2941 {
2942 #ifdef CONFIG_B43_HWRNG
2943         if (wl->rng_initialized)
2944                 hwrng_unregister(&wl->rng);
2945 #endif /* CONFIG_B43_HWRNG */
2946 }
2947
2948 static int b43_rng_init(struct b43_wl *wl)
2949 {
2950         int err = 0;
2951
2952 #ifdef CONFIG_B43_HWRNG
2953         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2954                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2955         wl->rng.name = wl->rng_name;
2956         wl->rng.data_read = b43_rng_read;
2957         wl->rng.priv = (unsigned long)wl;
2958         wl->rng_initialized = 1;
2959         err = hwrng_register(&wl->rng);
2960         if (err) {
2961                 wl->rng_initialized = 0;
2962                 b43err(wl, "Failed to register the random "
2963                        "number generator (%d)\n", err);
2964         }
2965 #endif /* CONFIG_B43_HWRNG */
2966
2967         return err;
2968 }
2969
2970 static int b43_op_tx(struct ieee80211_hw *hw,
2971                      struct sk_buff *skb)
2972 {
2973         struct b43_wl *wl = hw_to_b43_wl(hw);
2974         struct b43_wldev *dev = wl->current_dev;
2975         unsigned long flags;
2976         int err;
2977
2978         if (unlikely(skb->len < 2 + 2 + 6)) {
2979                 /* Too short, this can't be a valid frame. */
2980                 goto drop_packet;
2981         }
2982         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2983         if (unlikely(!dev))
2984                 goto drop_packet;
2985
2986         /* Transmissions on seperate queues can run concurrently. */
2987         read_lock_irqsave(&wl->tx_lock, flags);
2988
2989         err = -ENODEV;
2990         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2991                 if (b43_using_pio_transfers(dev))
2992                         err = b43_pio_tx(dev, skb);
2993                 else
2994                         err = b43_dma_tx(dev, skb);
2995         }
2996
2997         read_unlock_irqrestore(&wl->tx_lock, flags);
2998
2999         if (unlikely(err))
3000                 goto drop_packet;
3001         return NETDEV_TX_OK;
3002
3003 drop_packet:
3004         /* We can not transmit this packet. Drop it. */
3005         dev_kfree_skb_any(skb);
3006         return NETDEV_TX_OK;
3007 }
3008
3009 /* Locking: wl->irq_lock */
3010 static void b43_qos_params_upload(struct b43_wldev *dev,
3011                                   const struct ieee80211_tx_queue_params *p,
3012                                   u16 shm_offset)
3013 {
3014         u16 params[B43_NR_QOSPARAMS];
3015         int bslots, tmp;
3016         unsigned int i;
3017
3018         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3019
3020         memset(&params, 0, sizeof(params));
3021
3022         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3023         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3024         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3025         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3026         params[B43_QOSPARAM_AIFS] = p->aifs;
3027         params[B43_QOSPARAM_BSLOTS] = bslots;
3028         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3029
3030         for (i = 0; i < ARRAY_SIZE(params); i++) {
3031                 if (i == B43_QOSPARAM_STATUS) {
3032                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3033                                              shm_offset + (i * 2));
3034                         /* Mark the parameters as updated. */
3035                         tmp |= 0x100;
3036                         b43_shm_write16(dev, B43_SHM_SHARED,
3037                                         shm_offset + (i * 2),
3038                                         tmp);
3039                 } else {
3040                         b43_shm_write16(dev, B43_SHM_SHARED,
3041                                         shm_offset + (i * 2),
3042                                         params[i]);
3043                 }
3044         }
3045 }
3046
3047 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3048 static const u16 b43_qos_shm_offsets[] = {
3049         /* [mac80211-queue-nr] = SHM_OFFSET, */
3050         [0] = B43_QOS_VOICE,
3051         [1] = B43_QOS_VIDEO,
3052         [2] = B43_QOS_BESTEFFORT,
3053         [3] = B43_QOS_BACKGROUND,
3054 };
3055
3056 /* Update all QOS parameters in hardware. */
3057 static void b43_qos_upload_all(struct b43_wldev *dev)
3058 {
3059         struct b43_wl *wl = dev->wl;
3060         struct b43_qos_params *params;
3061         unsigned int i;
3062
3063         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3064                      ARRAY_SIZE(wl->qos_params));
3065
3066         b43_mac_suspend(dev);
3067         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3068                 params = &(wl->qos_params[i]);
3069                 b43_qos_params_upload(dev, &(params->p),
3070                                       b43_qos_shm_offsets[i]);
3071         }
3072         b43_mac_enable(dev);
3073 }
3074
3075 static void b43_qos_clear(struct b43_wl *wl)
3076 {
3077         struct b43_qos_params *params;
3078         unsigned int i;
3079
3080         /* Initialize QoS parameters to sane defaults. */
3081
3082         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3083                      ARRAY_SIZE(wl->qos_params));
3084
3085         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3086                 params = &(wl->qos_params[i]);
3087
3088                 switch (b43_qos_shm_offsets[i]) {
3089                 case B43_QOS_VOICE:
3090                         params->p.txop = 0;
3091                         params->p.aifs = 2;
3092                         params->p.cw_min = 0x0001;
3093                         params->p.cw_max = 0x0001;
3094                         break;
3095                 case B43_QOS_VIDEO:
3096                         params->p.txop = 0;
3097                         params->p.aifs = 2;
3098                         params->p.cw_min = 0x0001;
3099                         params->p.cw_max = 0x0001;
3100                         break;
3101                 case B43_QOS_BESTEFFORT:
3102                         params->p.txop = 0;
3103                         params->p.aifs = 3;
3104                         params->p.cw_min = 0x0001;
3105                         params->p.cw_max = 0x03FF;
3106                         break;
3107                 case B43_QOS_BACKGROUND:
3108                         params->p.txop = 0;
3109                         params->p.aifs = 7;
3110                         params->p.cw_min = 0x0001;
3111                         params->p.cw_max = 0x03FF;
3112                         break;
3113                 default:
3114                         B43_WARN_ON(1);
3115                 }
3116         }
3117 }
3118
3119 /* Initialize the core's QOS capabilities */
3120 static void b43_qos_init(struct b43_wldev *dev)
3121 {
3122         /* Upload the current QOS parameters. */
3123         b43_qos_upload_all(dev);
3124
3125         /* Enable QOS support. */
3126         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3127         b43_write16(dev, B43_MMIO_IFSCTL,
3128                     b43_read16(dev, B43_MMIO_IFSCTL)
3129                     | B43_MMIO_IFSCTL_USE_EDCF);
3130 }
3131
3132 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3133                           const struct ieee80211_tx_queue_params *params)
3134 {
3135         struct b43_wl *wl = hw_to_b43_wl(hw);
3136         struct b43_wldev *dev;
3137         unsigned int queue = (unsigned int)_queue;
3138         int err = -ENODEV;
3139
3140         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3141                 /* Queue not available or don't support setting
3142                  * params on this queue. Return success to not
3143                  * confuse mac80211. */
3144                 return 0;
3145         }
3146         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3147                      ARRAY_SIZE(wl->qos_params));
3148
3149         mutex_lock(&wl->mutex);
3150         dev = wl->current_dev;
3151         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3152                 goto out_unlock;
3153
3154         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3155         b43_mac_suspend(dev);
3156         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3157                               b43_qos_shm_offsets[queue]);
3158         b43_mac_enable(dev);
3159         err = 0;
3160
3161 out_unlock:
3162         mutex_unlock(&wl->mutex);
3163
3164         return err;
3165 }
3166
3167 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3168                                struct ieee80211_tx_queue_stats *stats)
3169 {
3170         struct b43_wl *wl = hw_to_b43_wl(hw);
3171         struct b43_wldev *dev = wl->current_dev;
3172         unsigned long flags;
3173         int err = -ENODEV;
3174
3175         if (!dev)
3176                 goto out;
3177         spin_lock_irqsave(&wl->irq_lock, flags);
3178         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3179                 if (b43_using_pio_transfers(dev))
3180                         b43_pio_get_tx_stats(dev, stats);
3181                 else
3182                         b43_dma_get_tx_stats(dev, stats);
3183                 err = 0;
3184         }
3185         spin_unlock_irqrestore(&wl->irq_lock, flags);
3186 out:
3187         return err;
3188 }
3189
3190 static int b43_op_get_stats(struct ieee80211_hw *hw,
3191                             struct ieee80211_low_level_stats *stats)
3192 {
3193         struct b43_wl *wl = hw_to_b43_wl(hw);
3194         unsigned long flags;
3195
3196         spin_lock_irqsave(&wl->irq_lock, flags);
3197         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3198         spin_unlock_irqrestore(&wl->irq_lock, flags);
3199
3200         return 0;
3201 }
3202
3203 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3204 {
3205         struct b43_wl *wl = hw_to_b43_wl(hw);
3206         struct b43_wldev *dev;
3207         u64 tsf;
3208
3209         mutex_lock(&wl->mutex);
3210         spin_lock_irq(&wl->irq_lock);
3211         dev = wl->current_dev;
3212
3213         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3214                 b43_tsf_read(dev, &tsf);
3215         else
3216                 tsf = 0;
3217
3218         spin_unlock_irq(&wl->irq_lock);
3219         mutex_unlock(&wl->mutex);
3220
3221         return tsf;
3222 }
3223
3224 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3225 {
3226         struct b43_wl *wl = hw_to_b43_wl(hw);
3227         struct b43_wldev *dev;
3228
3229         mutex_lock(&wl->mutex);
3230         spin_lock_irq(&wl->irq_lock);
3231         dev = wl->current_dev;
3232
3233         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3234                 b43_tsf_write(dev, tsf);
3235
3236         spin_unlock_irq(&wl->irq_lock);
3237         mutex_unlock(&wl->mutex);
3238 }
3239
3240 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3241 {
3242         struct ssb_device *sdev = dev->dev;
3243         u32 tmslow;
3244
3245         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3246         tmslow &= ~B43_TMSLOW_GMODE;
3247         tmslow |= B43_TMSLOW_PHYRESET;
3248         tmslow |= SSB_TMSLOW_FGC;
3249         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3250         msleep(1);
3251
3252         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3253         tmslow &= ~SSB_TMSLOW_FGC;
3254         tmslow |= B43_TMSLOW_PHYRESET;
3255         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3256         msleep(1);
3257 }
3258
3259 static const char *band_to_string(enum ieee80211_band band)
3260 {
3261         switch (band) {
3262         case IEEE80211_BAND_5GHZ:
3263                 return "5";
3264         case IEEE80211_BAND_2GHZ:
3265                 return "2.4";
3266         default:
3267                 break;
3268         }
3269         B43_WARN_ON(1);
3270         return "";
3271 }
3272
3273 /* Expects wl->mutex locked */
3274 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3275 {
3276         struct b43_wldev *up_dev = NULL;
3277         struct b43_wldev *down_dev;
3278         struct b43_wldev *d;
3279         int err;
3280         bool uninitialized_var(gmode);
3281         int prev_status;
3282
3283         /* Find a device and PHY which supports the band. */
3284         list_for_each_entry(d, &wl->devlist, list) {
3285                 switch (chan->band) {
3286                 case IEEE80211_BAND_5GHZ:
3287                         if (d->phy.supports_5ghz) {
3288                                 up_dev = d;
3289                                 gmode = 0;
3290                         }
3291                         break;
3292                 case IEEE80211_BAND_2GHZ:
3293                         if (d->phy.supports_2ghz) {
3294                                 up_dev = d;
3295                                 gmode = 1;
3296                         }
3297                         break;
3298                 default:
3299                         B43_WARN_ON(1);
3300                         return -EINVAL;
3301                 }
3302                 if (up_dev)
3303                         break;
3304         }
3305         if (!up_dev) {
3306                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3307                        band_to_string(chan->band));
3308                 return -ENODEV;
3309         }
3310         if ((up_dev == wl->current_dev) &&
3311             (!!wl->current_dev->phy.gmode == !!gmode)) {
3312                 /* This device is already running. */
3313                 return 0;
3314         }
3315         b43dbg(wl, "Switching to %s-GHz band\n",
3316                band_to_string(chan->band));
3317         down_dev = wl->current_dev;
3318
3319         prev_status = b43_status(down_dev);
3320         /* Shutdown the currently running core. */
3321         if (prev_status >= B43_STAT_STARTED)
3322                 b43_wireless_core_stop(down_dev);
3323         if (prev_status >= B43_STAT_INITIALIZED)
3324                 b43_wireless_core_exit(down_dev);
3325
3326         if (down_dev != up_dev) {
3327                 /* We switch to a different core, so we put PHY into
3328                  * RESET on the old core. */
3329                 b43_put_phy_into_reset(down_dev);
3330         }
3331
3332         /* Now start the new core. */
3333         up_dev->phy.gmode = gmode;
3334         if (prev_status >= B43_STAT_INITIALIZED) {
3335                 err = b43_wireless_core_init(up_dev);
3336                 if (err) {
3337                         b43err(wl, "Fatal: Could not initialize device for "
3338                                "selected %s-GHz band\n",
3339                                band_to_string(chan->band));
3340                         goto init_failure;
3341                 }
3342         }
3343         if (prev_status >= B43_STAT_STARTED) {
3344                 err = b43_wireless_core_start(up_dev);
3345                 if (err) {
3346                         b43err(wl, "Fatal: Coult not start device for "
3347                                "selected %s-GHz band\n",
3348                                band_to_string(chan->band));
3349                         b43_wireless_core_exit(up_dev);
3350                         goto init_failure;
3351                 }
3352         }
3353         B43_WARN_ON(b43_status(up_dev) != prev_status);
3354
3355         wl->current_dev = up_dev;
3356
3357         return 0;
3358 init_failure:
3359         /* Whoops, failed to init the new core. No core is operating now. */
3360         wl->current_dev = NULL;
3361         return err;
3362 }
3363
3364 /* Write the short and long frame retry limit values. */
3365 static void b43_set_retry_limits(struct b43_wldev *dev,
3366                                  unsigned int short_retry,
3367                                  unsigned int long_retry)
3368 {
3369         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3370          * the chip-internal counter. */
3371         short_retry = min(short_retry, (unsigned int)0xF);
3372         long_retry = min(long_retry, (unsigned int)0xF);
3373
3374         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3375                         short_retry);
3376         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3377                         long_retry);
3378 }
3379
3380 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3381 {
3382         struct b43_wl *wl = hw_to_b43_wl(hw);
3383         struct b43_wldev *dev;
3384         struct b43_phy *phy;
3385         struct ieee80211_conf *conf = &hw->conf;
3386         unsigned long flags;
3387         int antenna;
3388         int err = 0;
3389
3390         mutex_lock(&wl->mutex);
3391
3392         /* Switch the band (if necessary). This might change the active core. */
3393         err = b43_switch_band(wl, conf->channel);
3394         if (err)
3395                 goto out_unlock_mutex;
3396         dev = wl->current_dev;
3397         phy = &dev->phy;
3398
3399         b43_mac_suspend(dev);
3400
3401         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3402                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3403                                           conf->long_frame_max_tx_count);
3404         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3405         if (!changed)
3406                 goto out_mac_enable;
3407
3408         /* Switch to the requested channel.
3409          * The firmware takes care of races with the TX handler. */
3410         if (conf->channel->hw_value != phy->channel)
3411                 b43_switch_channel(dev, conf->channel->hw_value);
3412
3413         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3414
3415         /* Adjust the desired TX power level. */
3416         if (conf->power_level != 0) {
3417                 spin_lock_irqsave(&wl->irq_lock, flags);
3418                 if (conf->power_level != phy->desired_txpower) {
3419                         phy->desired_txpower = conf->power_level;
3420                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3421                                                    B43_TXPWR_IGNORE_TSSI);
3422                 }
3423                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3424         }
3425
3426         /* Antennas for RX and management frame TX. */
3427         antenna = B43_ANTENNA_DEFAULT;
3428         b43_mgmtframe_txantenna(dev, antenna);
3429         antenna = B43_ANTENNA_DEFAULT;
3430         if (phy->ops->set_rx_antenna)
3431                 phy->ops->set_rx_antenna(dev, antenna);
3432
3433         if (wl->radio_enabled != phy->radio_on) {
3434                 if (wl->radio_enabled) {
3435                         b43_software_rfkill(dev, false);
3436                         b43info(dev->wl, "Radio turned on by software\n");
3437                         if (!dev->radio_hw_enable) {
3438                                 b43info(dev->wl, "The hardware RF-kill button "
3439                                         "still turns the radio physically off. "
3440                                         "Press the button to turn it on.\n");
3441                         }
3442                 } else {
3443                         b43_software_rfkill(dev, true);
3444                         b43info(dev->wl, "Radio turned off by software\n");
3445                 }
3446         }
3447
3448 out_mac_enable:
3449         b43_mac_enable(dev);
3450 out_unlock_mutex:
3451         mutex_unlock(&wl->mutex);
3452
3453         return err;
3454 }
3455
3456 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3457 {
3458         struct ieee80211_supported_band *sband =
3459                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3460         struct ieee80211_rate *rate;
3461         int i;
3462         u16 basic, direct, offset, basic_offset, rateptr;
3463
3464         for (i = 0; i < sband->n_bitrates; i++) {
3465                 rate = &sband->bitrates[i];
3466
3467                 if (b43_is_cck_rate(rate->hw_value)) {
3468                         direct = B43_SHM_SH_CCKDIRECT;
3469                         basic = B43_SHM_SH_CCKBASIC;
3470                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3471                         offset &= 0xF;
3472                 } else {
3473                         direct = B43_SHM_SH_OFDMDIRECT;
3474                         basic = B43_SHM_SH_OFDMBASIC;
3475                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3476                         offset &= 0xF;
3477                 }
3478
3479                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3480
3481                 if (b43_is_cck_rate(rate->hw_value)) {
3482                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3483                         basic_offset &= 0xF;
3484                 } else {
3485                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3486                         basic_offset &= 0xF;
3487                 }
3488
3489                 /*
3490                  * Get the pointer that we need to point to
3491                  * from the direct map
3492                  */
3493                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3494                                          direct + 2 * basic_offset);
3495                 /* and write it to the basic map */
3496                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3497                                 rateptr);
3498         }
3499 }
3500
3501 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3502                                     struct ieee80211_vif *vif,
3503                                     struct ieee80211_bss_conf *conf,
3504                                     u32 changed)
3505 {
3506         struct b43_wl *wl = hw_to_b43_wl(hw);
3507         struct b43_wldev *dev;
3508         unsigned long flags;
3509
3510         mutex_lock(&wl->mutex);
3511
3512         dev = wl->current_dev;
3513         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3514                 goto out_unlock_mutex;
3515
3516         B43_WARN_ON(wl->vif != vif);
3517
3518         spin_lock_irqsave(&wl->irq_lock, flags);
3519         if (changed & BSS_CHANGED_BSSID) {
3520                 if (conf->bssid)
3521                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3522                 else
3523                         memset(wl->bssid, 0, ETH_ALEN);
3524         }
3525
3526         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3527                 if (changed & BSS_CHANGED_BEACON &&
3528                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3529                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3530                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3531                         b43_update_templates(wl);
3532
3533                 if (changed & BSS_CHANGED_BSSID)
3534                         b43_write_mac_bssid_templates(dev);
3535         }
3536         spin_unlock_irqrestore(&wl->irq_lock, flags);
3537
3538         b43_mac_suspend(dev);
3539
3540         /* Update templates for AP/mesh mode. */
3541         if (changed & BSS_CHANGED_BEACON_INT &&
3542             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3543              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3544              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3545                 b43_set_beacon_int(dev, conf->beacon_int);
3546
3547         if (changed & BSS_CHANGED_BASIC_RATES)
3548                 b43_update_basic_rates(dev, conf->basic_rates);
3549
3550         if (changed & BSS_CHANGED_ERP_SLOT) {
3551                 if (conf->use_short_slot)
3552                         b43_short_slot_timing_enable(dev);
3553                 else
3554                         b43_short_slot_timing_disable(dev);
3555         }
3556
3557         b43_mac_enable(dev);
3558 out_unlock_mutex:
3559         mutex_unlock(&wl->mutex);
3560 }
3561
3562 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3563                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3564                           struct ieee80211_key_conf *key)
3565 {
3566         struct b43_wl *wl = hw_to_b43_wl(hw);
3567         struct b43_wldev *dev;
3568         u8 algorithm;
3569         u8 index;
3570         int err;
3571         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3572
3573         if (modparam_nohwcrypt)
3574                 return -ENOSPC; /* User disabled HW-crypto */
3575
3576         mutex_lock(&wl->mutex);
3577         spin_lock_irq(&wl->irq_lock);
3578         write_lock(&wl->tx_lock);
3579         /* Why do we need all this locking here?
3580          * mutex     -> Every config operation must take it.
3581          * irq_lock  -> We modify the dev->key array, which is accessed
3582          *              in the IRQ handlers.
3583          * tx_lock   -> We modify the dev->key array, which is accessed
3584          *              in the TX handler.
3585          */
3586
3587         dev = wl->current_dev;
3588         err = -ENODEV;
3589         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3590                 goto out_unlock;
3591
3592         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3593                 /* We don't have firmware for the crypto engine.
3594                  * Must use software-crypto. */
3595                 err = -EOPNOTSUPP;
3596                 goto out_unlock;
3597         }
3598
3599         err = -EINVAL;
3600         switch (key->alg) {
3601         case ALG_WEP:
3602                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3603                         algorithm = B43_SEC_ALGO_WEP40;
3604                 else
3605                         algorithm = B43_SEC_ALGO_WEP104;
3606                 break;
3607         case ALG_TKIP:
3608                 algorithm = B43_SEC_ALGO_TKIP;
3609                 break;
3610         case ALG_CCMP:
3611                 algorithm = B43_SEC_ALGO_AES;
3612                 break;
3613         default:
3614                 B43_WARN_ON(1);
3615                 goto out_unlock;
3616         }
3617         index = (u8) (key->keyidx);
3618         if (index > 3)
3619                 goto out_unlock;
3620
3621         switch (cmd) {
3622         case SET_KEY:
3623                 if (algorithm == B43_SEC_ALGO_TKIP) {
3624                         /* FIXME: No TKIP hardware encryption for now. */
3625                         err = -EOPNOTSUPP;
3626                         goto out_unlock;
3627                 }
3628
3629                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3630                         if (WARN_ON(!sta)) {
3631                                 err = -EOPNOTSUPP;
3632                                 goto out_unlock;
3633                         }
3634                         /* Pairwise key with an assigned MAC address. */
3635                         err = b43_key_write(dev, -1, algorithm,
3636                                             key->key, key->keylen,
3637                                             sta->addr, key);
3638                 } else {
3639                         /* Group key */
3640                         err = b43_key_write(dev, index, algorithm,
3641                                             key->key, key->keylen, NULL, key);
3642                 }
3643                 if (err)
3644                         goto out_unlock;
3645
3646                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3647                     algorithm == B43_SEC_ALGO_WEP104) {
3648                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3649                 } else {
3650                         b43_hf_write(dev,
3651                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3652                 }
3653                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3654                 break;
3655         case DISABLE_KEY: {
3656                 err = b43_key_clear(dev, key->hw_key_idx);
3657                 if (err)
3658                         goto out_unlock;
3659                 break;
3660         }
3661         default:
3662                 B43_WARN_ON(1);
3663         }
3664
3665 out_unlock:
3666         if (!err) {
3667                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3668                        "mac: %pM\n",
3669                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3670                        sta ? sta->addr : bcast_addr);
3671                 b43_dump_keymemory(dev);
3672         }
3673         write_unlock(&wl->tx_lock);
3674         spin_unlock_irq(&wl->irq_lock);
3675         mutex_unlock(&wl->mutex);
3676
3677         return err;
3678 }
3679
3680 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3681                                     unsigned int changed, unsigned int *fflags,
3682                                     int mc_count, struct dev_addr_list *mc_list)
3683 {
3684         struct b43_wl *wl = hw_to_b43_wl(hw);
3685         struct b43_wldev *dev = wl->current_dev;
3686         unsigned long flags;
3687
3688         if (!dev) {
3689                 *fflags = 0;
3690                 return;
3691         }
3692
3693         spin_lock_irqsave(&wl->irq_lock, flags);
3694         *fflags &= FIF_PROMISC_IN_BSS |
3695                   FIF_ALLMULTI |
3696                   FIF_FCSFAIL |
3697                   FIF_PLCPFAIL |
3698                   FIF_CONTROL |
3699                   FIF_OTHER_BSS |
3700                   FIF_BCN_PRBRESP_PROMISC;
3701
3702         changed &= FIF_PROMISC_IN_BSS |
3703                    FIF_ALLMULTI |
3704                    FIF_FCSFAIL |
3705                    FIF_PLCPFAIL |
3706                    FIF_CONTROL |
3707                    FIF_OTHER_BSS |
3708                    FIF_BCN_PRBRESP_PROMISC;
3709
3710         wl->filter_flags = *fflags;
3711
3712         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3713                 b43_adjust_opmode(dev);
3714         spin_unlock_irqrestore(&wl->irq_lock, flags);
3715 }
3716
3717 /* Locking: wl->mutex */
3718 static void b43_wireless_core_stop(struct b43_wldev *dev)
3719 {
3720         struct b43_wl *wl = dev->wl;
3721         unsigned long flags;
3722
3723         if (b43_status(dev) < B43_STAT_STARTED)
3724                 return;
3725
3726         /* Disable and sync interrupts. We must do this before than
3727          * setting the status to INITIALIZED, as the interrupt handler
3728          * won't care about IRQs then. */
3729         spin_lock_irqsave(&wl->irq_lock, flags);
3730         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3731         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3732         spin_unlock_irqrestore(&wl->irq_lock, flags);
3733         b43_synchronize_irq(dev);
3734
3735         write_lock_irqsave(&wl->tx_lock, flags);
3736         b43_set_status(dev, B43_STAT_INITIALIZED);
3737         write_unlock_irqrestore(&wl->tx_lock, flags);
3738
3739         b43_pio_stop(dev);
3740         mutex_unlock(&wl->mutex);
3741         /* Must unlock as it would otherwise deadlock. No races here.
3742          * Cancel the possibly running self-rearming periodic work. */
3743         cancel_delayed_work_sync(&dev->periodic_work);
3744         mutex_lock(&wl->mutex);
3745
3746         b43_mac_suspend(dev);
3747         free_irq(dev->dev->irq, dev);
3748         b43dbg(wl, "Wireless interface stopped\n");
3749 }
3750
3751 /* Locking: wl->mutex */
3752 static int b43_wireless_core_start(struct b43_wldev *dev)
3753 {
3754         int err;
3755
3756         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3757
3758         drain_txstatus_queue(dev);
3759         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3760                           IRQF_SHARED, KBUILD_MODNAME, dev);
3761         if (err) {
3762                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3763                 goto out;
3764         }
3765
3766         /* We are ready to run. */
3767         b43_set_status(dev, B43_STAT_STARTED);
3768
3769         /* Start data flow (TX/RX). */
3770         b43_mac_enable(dev);
3771         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3772
3773         /* Start maintainance work */
3774         b43_periodic_tasks_setup(dev);
3775
3776         b43dbg(dev->wl, "Wireless interface started\n");
3777       out:
3778         return err;
3779 }
3780
3781 /* Get PHY and RADIO versioning numbers */
3782 static int b43_phy_versioning(struct b43_wldev *dev)
3783 {
3784         struct b43_phy *phy = &dev->phy;
3785         u32 tmp;
3786         u8 analog_type;
3787         u8 phy_type;
3788         u8 phy_rev;
3789         u16 radio_manuf;
3790         u16 radio_ver;
3791         u16 radio_rev;
3792         int unsupported = 0;
3793
3794         /* Get PHY versioning */
3795         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3796         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3797         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3798         phy_rev = (tmp & B43_PHYVER_VERSION);
3799         switch (phy_type) {
3800         case B43_PHYTYPE_A:
3801                 if (phy_rev >= 4)
3802                         unsupported = 1;
3803                 break;
3804         case B43_PHYTYPE_B:
3805                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3806                     && phy_rev != 7)
3807                         unsupported = 1;
3808                 break;
3809         case B43_PHYTYPE_G:
3810                 if (phy_rev > 9)
3811                         unsupported = 1;
3812                 break;
3813 #ifdef CONFIG_B43_NPHY
3814         case B43_PHYTYPE_N:
3815                 if (phy_rev > 4)
3816                         unsupported = 1;
3817                 break;
3818 #endif
3819 #ifdef CONFIG_B43_PHY_LP
3820         case B43_PHYTYPE_LP:
3821                 if (phy_rev > 2)
3822                         unsupported = 1;
3823                 break;
3824 #endif
3825         default:
3826                 unsupported = 1;
3827         };
3828         if (unsupported) {
3829                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3830                        "(Analog %u, Type %u, Revision %u)\n",
3831                        analog_type, phy_type, phy_rev);
3832                 return -EOPNOTSUPP;
3833         }
3834         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3835                analog_type, phy_type, phy_rev);
3836
3837         /* Get RADIO versioning */
3838         if (dev->dev->bus->chip_id == 0x4317) {
3839                 if (dev->dev->bus->chip_rev == 0)
3840                         tmp = 0x3205017F;
3841                 else if (dev->dev->bus->chip_rev == 1)
3842                         tmp = 0x4205017F;
3843                 else
3844                         tmp = 0x5205017F;
3845         } else {
3846                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3847                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3848                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3849                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3850         }
3851         radio_manuf = (tmp & 0x00000FFF);
3852         radio_ver = (tmp & 0x0FFFF000) >> 12;
3853         radio_rev = (tmp & 0xF0000000) >> 28;
3854         if (radio_manuf != 0x17F /* Broadcom */)
3855                 unsupported = 1;
3856         switch (phy_type) {
3857         case B43_PHYTYPE_A:
3858                 if (radio_ver != 0x2060)
3859                         unsupported = 1;
3860                 if (radio_rev != 1)
3861                         unsupported = 1;
3862                 if (radio_manuf != 0x17F)
3863                         unsupported = 1;
3864                 break;
3865         case B43_PHYTYPE_B:
3866                 if ((radio_ver & 0xFFF0) != 0x2050)
3867                         unsupported = 1;
3868                 break;
3869         case B43_PHYTYPE_G:
3870                 if (radio_ver != 0x2050)
3871                         unsupported = 1;
3872                 break;
3873         case B43_PHYTYPE_N:
3874                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3875                         unsupported = 1;
3876                 break;
3877         case B43_PHYTYPE_LP:
3878                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
3879                         unsupported = 1;
3880                 break;
3881         default:
3882                 B43_WARN_ON(1);
3883         }
3884         if (unsupported) {
3885                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3886                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3887                        radio_manuf, radio_ver, radio_rev);
3888                 return -EOPNOTSUPP;
3889         }
3890         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3891                radio_manuf, radio_ver, radio_rev);
3892
3893         phy->radio_manuf = radio_manuf;
3894         phy->radio_ver = radio_ver;
3895         phy->radio_rev = radio_rev;
3896
3897         phy->analog = analog_type;
3898         phy->type = phy_type;
3899         phy->rev = phy_rev;
3900
3901         return 0;
3902 }
3903
3904 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3905                                       struct b43_phy *phy)
3906 {
3907         phy->hardware_power_control = !!modparam_hwpctl;
3908         phy->next_txpwr_check_time = jiffies;
3909         /* PHY TX errors counter. */
3910         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3911
3912 #if B43_DEBUG
3913         phy->phy_locked = 0;
3914         phy->radio_locked = 0;
3915 #endif
3916 }
3917
3918 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3919 {
3920         dev->dfq_valid = 0;
3921
3922         /* Assume the radio is enabled. If it's not enabled, the state will
3923          * immediately get fixed on the first periodic work run. */
3924         dev->radio_hw_enable = 1;
3925
3926         /* Stats */
3927         memset(&dev->stats, 0, sizeof(dev->stats));
3928
3929         setup_struct_phy_for_init(dev, &dev->phy);
3930
3931         /* IRQ related flags */
3932         dev->irq_reason = 0;
3933         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3934         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
3935         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
3936                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
3937
3938         dev->mac_suspended = 1;
3939
3940         /* Noise calculation context */
3941         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3942 }
3943
3944 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3945 {
3946         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3947         u64 hf;
3948
3949         if (!modparam_btcoex)
3950                 return;
3951         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3952                 return;
3953         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3954                 return;
3955
3956         hf = b43_hf_read(dev);
3957         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3958                 hf |= B43_HF_BTCOEXALT;
3959         else
3960                 hf |= B43_HF_BTCOEX;
3961         b43_hf_write(dev, hf);
3962 }
3963
3964 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3965 {
3966         if (!modparam_btcoex)
3967                 return;
3968         //TODO
3969 }
3970
3971 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3972 {
3973 #ifdef CONFIG_SSB_DRIVER_PCICORE
3974         struct ssb_bus *bus = dev->dev->bus;
3975         u32 tmp;
3976
3977         if (bus->pcicore.dev &&
3978             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3979             bus->pcicore.dev->id.revision <= 5) {
3980                 /* IMCFGLO timeouts workaround. */
3981                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3982                 tmp &= ~SSB_IMCFGLO_REQTO;
3983                 tmp &= ~SSB_IMCFGLO_SERTO;
3984                 switch (bus->bustype) {
3985                 case SSB_BUSTYPE_PCI:
3986                 case SSB_BUSTYPE_PCMCIA:
3987                         tmp |= 0x32;
3988                         break;
3989                 case SSB_BUSTYPE_SSB:
3990                         tmp |= 0x53;
3991                         break;
3992                 }
3993                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3994         }
3995 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3996 }
3997
3998 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3999 {
4000         u16 pu_delay;
4001
4002         /* The time value is in microseconds. */
4003         if (dev->phy.type == B43_PHYTYPE_A)
4004                 pu_delay = 3700;
4005         else
4006                 pu_delay = 1050;
4007         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4008                 pu_delay = 500;
4009         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4010                 pu_delay = max(pu_delay, (u16)2400);
4011
4012         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4013 }
4014
4015 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4016 static void b43_set_pretbtt(struct b43_wldev *dev)
4017 {
4018         u16 pretbtt;
4019
4020         /* The time value is in microseconds. */
4021         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4022                 pretbtt = 2;
4023         } else {
4024                 if (dev->phy.type == B43_PHYTYPE_A)
4025                         pretbtt = 120;
4026                 else
4027                         pretbtt = 250;
4028         }
4029         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4030         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4031 }
4032
4033 /* Shutdown a wireless core */
4034 /* Locking: wl->mutex */
4035 static void b43_wireless_core_exit(struct b43_wldev *dev)
4036 {
4037         u32 macctl;
4038
4039         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4040         if (b43_status(dev) != B43_STAT_INITIALIZED)
4041                 return;
4042         b43_set_status(dev, B43_STAT_UNINIT);
4043
4044         /* Stop the microcode PSM. */
4045         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4046         macctl &= ~B43_MACCTL_PSM_RUN;
4047         macctl |= B43_MACCTL_PSM_JMP0;
4048         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4049
4050         if (!dev->suspend_in_progress) {
4051                 b43_leds_exit(dev);
4052                 b43_rng_exit(dev->wl);
4053         }
4054         b43_dma_free(dev);
4055         b43_pio_free(dev);
4056         b43_chip_exit(dev);
4057         dev->phy.ops->switch_analog(dev, 0);
4058         if (dev->wl->current_beacon) {
4059                 dev_kfree_skb_any(dev->wl->current_beacon);
4060                 dev->wl->current_beacon = NULL;
4061         }
4062
4063         ssb_device_disable(dev->dev, 0);
4064         ssb_bus_may_powerdown(dev->dev->bus);
4065 }
4066
4067 /* Initialize a wireless core */
4068 static int b43_wireless_core_init(struct b43_wldev *dev)
4069 {
4070         struct b43_wl *wl = dev->wl;
4071         struct ssb_bus *bus = dev->dev->bus;
4072         struct ssb_sprom *sprom = &bus->sprom;
4073         struct b43_phy *phy = &dev->phy;
4074         int err;
4075         u64 hf;
4076         u32 tmp;
4077
4078         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4079
4080         err = ssb_bus_powerup(bus, 0);
4081         if (err)
4082                 goto out;
4083         if (!ssb_device_is_enabled(dev->dev)) {
4084                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4085                 b43_wireless_core_reset(dev, tmp);
4086         }
4087
4088         /* Reset all data structures. */
4089         setup_struct_wldev_for_init(dev);
4090         phy->ops->prepare_structs(dev);
4091
4092         /* Enable IRQ routing to this device. */
4093         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4094
4095         b43_imcfglo_timeouts_workaround(dev);
4096         b43_bluetooth_coext_disable(dev);
4097         if (phy->ops->prepare_hardware) {
4098                 err = phy->ops->prepare_hardware(dev);
4099                 if (err)
4100                         goto err_busdown;
4101         }
4102         err = b43_chip_init(dev);
4103         if (err)
4104                 goto err_busdown;
4105         b43_shm_write16(dev, B43_SHM_SHARED,
4106                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4107         hf = b43_hf_read(dev);
4108         if (phy->type == B43_PHYTYPE_G) {
4109                 hf |= B43_HF_SYMW;
4110                 if (phy->rev == 1)
4111                         hf |= B43_HF_GDCW;
4112                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4113                         hf |= B43_HF_OFDMPABOOST;
4114         }
4115         if (phy->radio_ver == 0x2050) {
4116                 if (phy->radio_rev == 6)
4117                         hf |= B43_HF_4318TSSI;
4118                 if (phy->radio_rev < 6)
4119                         hf |= B43_HF_VCORECALC;
4120         }
4121         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4122                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4123 #ifdef CONFIG_SSB_DRIVER_PCICORE
4124         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4125             (bus->pcicore.dev->id.revision <= 10))
4126                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4127 #endif
4128         hf &= ~B43_HF_SKCFPUP;
4129         b43_hf_write(dev, hf);
4130
4131         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4132                              B43_DEFAULT_LONG_RETRY_LIMIT);
4133         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4134         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4135
4136         /* Disable sending probe responses from firmware.
4137          * Setting the MaxTime to one usec will always trigger
4138          * a timeout, so we never send any probe resp.
4139          * A timeout of zero is infinite. */
4140         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4141
4142         b43_rate_memory_init(dev);
4143         b43_set_phytxctl_defaults(dev);
4144
4145         /* Minimum Contention Window */
4146         if (phy->type == B43_PHYTYPE_B) {
4147                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4148         } else {
4149                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4150         }
4151         /* Maximum Contention Window */
4152         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4153
4154         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4155                 dev->__using_pio_transfers = 1;
4156                 err = b43_pio_init(dev);
4157         } else {
4158                 dev->__using_pio_transfers = 0;
4159                 err = b43_dma_init(dev);
4160         }
4161         if (err)
4162                 goto err_chip_exit;
4163         b43_qos_init(dev);
4164         b43_set_synth_pu_delay(dev, 1);
4165         b43_bluetooth_coext_enable(dev);
4166
4167         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4168         b43_upload_card_macaddress(dev);
4169         b43_security_init(dev);
4170         if (!dev->suspend_in_progress)
4171                 b43_rng_init(wl);
4172
4173         b43_set_status(dev, B43_STAT_INITIALIZED);
4174
4175         if (!dev->suspend_in_progress)
4176                 b43_leds_init(dev);
4177 out:
4178         return err;
4179
4180 err_chip_exit:
4181         b43_chip_exit(dev);
4182 err_busdown:
4183         ssb_bus_may_powerdown(bus);
4184         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4185         return err;
4186 }
4187
4188 static int b43_op_add_interface(struct ieee80211_hw *hw,
4189                                 struct ieee80211_if_init_conf *conf)
4190 {
4191         struct b43_wl *wl = hw_to_b43_wl(hw);
4192         struct b43_wldev *dev;
4193         unsigned long flags;
4194         int err = -EOPNOTSUPP;
4195
4196         /* TODO: allow WDS/AP devices to coexist */
4197
4198         if (conf->type != NL80211_IFTYPE_AP &&
4199             conf->type != NL80211_IFTYPE_MESH_POINT &&
4200             conf->type != NL80211_IFTYPE_STATION &&
4201             conf->type != NL80211_IFTYPE_WDS &&
4202             conf->type != NL80211_IFTYPE_ADHOC)
4203                 return -EOPNOTSUPP;
4204
4205         mutex_lock(&wl->mutex);
4206         if (wl->operating)
4207                 goto out_mutex_unlock;
4208
4209         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4210
4211         dev = wl->current_dev;
4212         wl->operating = 1;
4213         wl->vif = conf->vif;
4214         wl->if_type = conf->type;
4215         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4216
4217         spin_lock_irqsave(&wl->irq_lock, flags);
4218         b43_adjust_opmode(dev);
4219         b43_set_pretbtt(dev);
4220         b43_set_synth_pu_delay(dev, 0);
4221         b43_upload_card_macaddress(dev);
4222         spin_unlock_irqrestore(&wl->irq_lock, flags);
4223
4224         err = 0;
4225  out_mutex_unlock:
4226         mutex_unlock(&wl->mutex);
4227
4228         return err;
4229 }
4230
4231 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4232                                     struct ieee80211_if_init_conf *conf)
4233 {
4234         struct b43_wl *wl = hw_to_b43_wl(hw);
4235         struct b43_wldev *dev = wl->current_dev;
4236         unsigned long flags;
4237
4238         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4239
4240         mutex_lock(&wl->mutex);
4241
4242         B43_WARN_ON(!wl->operating);
4243         B43_WARN_ON(wl->vif != conf->vif);
4244         wl->vif = NULL;
4245
4246         wl->operating = 0;
4247
4248         spin_lock_irqsave(&wl->irq_lock, flags);
4249         b43_adjust_opmode(dev);
4250         memset(wl->mac_addr, 0, ETH_ALEN);
4251         b43_upload_card_macaddress(dev);
4252         spin_unlock_irqrestore(&wl->irq_lock, flags);
4253
4254         mutex_unlock(&wl->mutex);
4255 }
4256
4257 static int b43_op_start(struct ieee80211_hw *hw)
4258 {
4259         struct b43_wl *wl = hw_to_b43_wl(hw);
4260         struct b43_wldev *dev = wl->current_dev;
4261         int did_init = 0;
4262         int err = 0;
4263
4264         /* Kill all old instance specific information to make sure
4265          * the card won't use it in the short timeframe between start
4266          * and mac80211 reconfiguring it. */
4267         memset(wl->bssid, 0, ETH_ALEN);
4268         memset(wl->mac_addr, 0, ETH_ALEN);
4269         wl->filter_flags = 0;
4270         wl->radiotap_enabled = 0;
4271         b43_qos_clear(wl);
4272         wl->beacon0_uploaded = 0;
4273         wl->beacon1_uploaded = 0;
4274         wl->beacon_templates_virgin = 1;
4275         wl->radio_enabled = 1;
4276
4277         mutex_lock(&wl->mutex);
4278
4279         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4280                 err = b43_wireless_core_init(dev);
4281                 if (err)
4282                         goto out_mutex_unlock;
4283                 did_init = 1;
4284         }
4285
4286         if (b43_status(dev) < B43_STAT_STARTED) {
4287                 err = b43_wireless_core_start(dev);
4288                 if (err) {
4289                         if (did_init)
4290                                 b43_wireless_core_exit(dev);
4291                         goto out_mutex_unlock;
4292                 }
4293         }
4294
4295         /* XXX: only do if device doesn't support rfkill irq */
4296         wiphy_rfkill_start_polling(hw->wiphy);
4297
4298  out_mutex_unlock:
4299         mutex_unlock(&wl->mutex);
4300
4301         return err;
4302 }
4303
4304 static void b43_op_stop(struct ieee80211_hw *hw)
4305 {
4306         struct b43_wl *wl = hw_to_b43_wl(hw);
4307         struct b43_wldev *dev = wl->current_dev;
4308
4309         cancel_work_sync(&(wl->beacon_update_trigger));
4310
4311         mutex_lock(&wl->mutex);
4312         if (b43_status(dev) >= B43_STAT_STARTED)
4313                 b43_wireless_core_stop(dev);
4314         b43_wireless_core_exit(dev);
4315         wl->radio_enabled = 0;
4316         mutex_unlock(&wl->mutex);
4317
4318         cancel_work_sync(&(wl->txpower_adjust_work));
4319 }
4320
4321 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4322                                  struct ieee80211_sta *sta, bool set)
4323 {
4324         struct b43_wl *wl = hw_to_b43_wl(hw);
4325         unsigned long flags;
4326
4327         spin_lock_irqsave(&wl->irq_lock, flags);
4328         b43_update_templates(wl);
4329         spin_unlock_irqrestore(&wl->irq_lock, flags);
4330
4331         return 0;
4332 }
4333
4334 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4335                               struct ieee80211_vif *vif,
4336                               enum sta_notify_cmd notify_cmd,
4337                               struct ieee80211_sta *sta)
4338 {
4339         struct b43_wl *wl = hw_to_b43_wl(hw);
4340
4341         B43_WARN_ON(!vif || wl->vif != vif);
4342 }
4343
4344 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4345 {
4346         struct b43_wl *wl = hw_to_b43_wl(hw);
4347         struct b43_wldev *dev;
4348
4349         mutex_lock(&wl->mutex);
4350         dev = wl->current_dev;
4351         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4352                 /* Disable CFP update during scan on other channels. */
4353                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4354         }
4355         mutex_unlock(&wl->mutex);
4356 }
4357
4358 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4359 {
4360         struct b43_wl *wl = hw_to_b43_wl(hw);
4361         struct b43_wldev *dev;
4362
4363         mutex_lock(&wl->mutex);
4364         dev = wl->current_dev;
4365         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4366                 /* Re-enable CFP update. */
4367                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4368         }
4369         mutex_unlock(&wl->mutex);
4370 }
4371
4372 static const struct ieee80211_ops b43_hw_ops = {
4373         .tx                     = b43_op_tx,
4374         .conf_tx                = b43_op_conf_tx,
4375         .add_interface          = b43_op_add_interface,
4376         .remove_interface       = b43_op_remove_interface,
4377         .config                 = b43_op_config,
4378         .bss_info_changed       = b43_op_bss_info_changed,
4379         .configure_filter       = b43_op_configure_filter,
4380         .set_key                = b43_op_set_key,
4381         .get_stats              = b43_op_get_stats,
4382         .get_tx_stats           = b43_op_get_tx_stats,
4383         .get_tsf                = b43_op_get_tsf,
4384         .set_tsf                = b43_op_set_tsf,
4385         .start                  = b43_op_start,
4386         .stop                   = b43_op_stop,
4387         .set_tim                = b43_op_beacon_set_tim,
4388         .sta_notify             = b43_op_sta_notify,
4389         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4390         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4391         .rfkill_poll            = b43_rfkill_poll,
4392 };
4393
4394 /* Hard-reset the chip. Do not call this directly.
4395  * Use b43_controller_restart()
4396  */
4397 static void b43_chip_reset(struct work_struct *work)
4398 {
4399         struct b43_wldev *dev =
4400             container_of(work, struct b43_wldev, restart_work);
4401         struct b43_wl *wl = dev->wl;
4402         int err = 0;
4403         int prev_status;
4404
4405         mutex_lock(&wl->mutex);
4406
4407         prev_status = b43_status(dev);
4408         /* Bring the device down... */
4409         if (prev_status >= B43_STAT_STARTED)
4410                 b43_wireless_core_stop(dev);
4411         if (prev_status >= B43_STAT_INITIALIZED)
4412                 b43_wireless_core_exit(dev);
4413
4414         /* ...and up again. */
4415         if (prev_status >= B43_STAT_INITIALIZED) {
4416                 err = b43_wireless_core_init(dev);
4417                 if (err)
4418                         goto out;
4419         }
4420         if (prev_status >= B43_STAT_STARTED) {
4421                 err = b43_wireless_core_start(dev);
4422                 if (err) {
4423                         b43_wireless_core_exit(dev);
4424                         goto out;
4425                 }
4426         }
4427 out:
4428         if (err)
4429                 wl->current_dev = NULL; /* Failed to init the dev. */
4430         mutex_unlock(&wl->mutex);
4431         if (err)
4432                 b43err(wl, "Controller restart FAILED\n");
4433         else
4434                 b43info(wl, "Controller restarted\n");
4435 }
4436
4437 static int b43_setup_bands(struct b43_wldev *dev,
4438                            bool have_2ghz_phy, bool have_5ghz_phy)
4439 {
4440         struct ieee80211_hw *hw = dev->wl->hw;
4441
4442         if (have_2ghz_phy)
4443                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4444         if (dev->phy.type == B43_PHYTYPE_N) {
4445                 if (have_5ghz_phy)
4446                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4447         } else {
4448                 if (have_5ghz_phy)
4449                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4450         }
4451
4452         dev->phy.supports_2ghz = have_2ghz_phy;
4453         dev->phy.supports_5ghz = have_5ghz_phy;
4454
4455         return 0;
4456 }
4457
4458 static void b43_wireless_core_detach(struct b43_wldev *dev)
4459 {
4460         /* We release firmware that late to not be required to re-request
4461          * is all the time when we reinit the core. */
4462         b43_release_firmware(dev);
4463         b43_phy_free(dev);
4464 }
4465
4466 static int b43_wireless_core_attach(struct b43_wldev *dev)
4467 {
4468         struct b43_wl *wl = dev->wl;
4469         struct ssb_bus *bus = dev->dev->bus;
4470         struct pci_dev *pdev = bus->host_pci;
4471         int err;
4472         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4473         u32 tmp;
4474
4475         /* Do NOT do any device initialization here.
4476          * Do it in wireless_core_init() instead.
4477          * This function is for gathering basic information about the HW, only.
4478          * Also some structs may be set up here. But most likely you want to have
4479          * that in core_init(), too.
4480          */
4481
4482         err = ssb_bus_powerup(bus, 0);
4483         if (err) {
4484                 b43err(wl, "Bus powerup failed\n");
4485                 goto out;
4486         }
4487         /* Get the PHY type. */
4488         if (dev->dev->id.revision >= 5) {
4489                 u32 tmshigh;
4490
4491                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4492                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4493                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4494         } else
4495                 B43_WARN_ON(1);
4496
4497         dev->phy.gmode = have_2ghz_phy;
4498         dev->phy.radio_on = 1;
4499         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4500         b43_wireless_core_reset(dev, tmp);
4501
4502         err = b43_phy_versioning(dev);
4503         if (err)
4504                 goto err_powerdown;
4505         /* Check if this device supports multiband. */
4506         if (!pdev ||
4507             (pdev->device != 0x4312 &&
4508              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4509                 /* No multiband support. */
4510                 have_2ghz_phy = 0;
4511                 have_5ghz_phy = 0;
4512                 switch (dev->phy.type) {
4513                 case B43_PHYTYPE_A:
4514                         have_5ghz_phy = 1;
4515                         break;
4516                 case B43_PHYTYPE_LP: //FIXME not always!
4517                         have_5ghz_phy = 1;
4518                 case B43_PHYTYPE_G:
4519                 case B43_PHYTYPE_N:
4520                         have_2ghz_phy = 1;
4521                         break;
4522                 default:
4523                         B43_WARN_ON(1);
4524                 }
4525         }
4526         if (dev->phy.type == B43_PHYTYPE_A) {
4527                 /* FIXME */
4528                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4529                 err = -EOPNOTSUPP;
4530                 goto err_powerdown;
4531         }
4532         if (1 /* disable A-PHY */) {
4533                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4534                 if (dev->phy.type != B43_PHYTYPE_N &&
4535                     dev->phy.type != B43_PHYTYPE_LP) {
4536                         have_2ghz_phy = 1;
4537                         have_5ghz_phy = 0;
4538                 }
4539         }
4540
4541         err = b43_phy_allocate(dev);
4542         if (err)
4543                 goto err_powerdown;
4544
4545         dev->phy.gmode = have_2ghz_phy;
4546         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4547         b43_wireless_core_reset(dev, tmp);
4548
4549         err = b43_validate_chipaccess(dev);
4550         if (err)
4551                 goto err_phy_free;
4552         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4553         if (err)
4554                 goto err_phy_free;
4555
4556         /* Now set some default "current_dev" */
4557         if (!wl->current_dev)
4558                 wl->current_dev = dev;
4559         INIT_WORK(&dev->restart_work, b43_chip_reset);
4560
4561         dev->phy.ops->switch_analog(dev, 0);
4562         ssb_device_disable(dev->dev, 0);
4563         ssb_bus_may_powerdown(bus);
4564
4565 out:
4566         return err;
4567
4568 err_phy_free:
4569         b43_phy_free(dev);
4570 err_powerdown:
4571         ssb_bus_may_powerdown(bus);
4572         return err;
4573 }
4574
4575 static void b43_one_core_detach(struct ssb_device *dev)
4576 {
4577         struct b43_wldev *wldev;
4578         struct b43_wl *wl;
4579
4580         /* Do not cancel ieee80211-workqueue based work here.
4581          * See comment in b43_remove(). */
4582
4583         wldev = ssb_get_drvdata(dev);
4584         wl = wldev->wl;
4585         b43_debugfs_remove_device(wldev);
4586         b43_wireless_core_detach(wldev);
4587         list_del(&wldev->list);
4588         wl->nr_devs--;
4589         ssb_set_drvdata(dev, NULL);
4590         kfree(wldev);
4591 }
4592
4593 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4594 {
4595         struct b43_wldev *wldev;
4596         struct pci_dev *pdev;
4597         int err = -ENOMEM;
4598
4599         if (!list_empty(&wl->devlist)) {
4600                 /* We are not the first core on this chip. */
4601                 pdev = dev->bus->host_pci;
4602                 /* Only special chips support more than one wireless
4603                  * core, although some of the other chips have more than
4604                  * one wireless core as well. Check for this and
4605                  * bail out early.
4606                  */
4607                 if (!pdev ||
4608                     ((pdev->device != 0x4321) &&
4609                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4610                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4611                         return -ENODEV;
4612                 }
4613         }
4614
4615         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4616         if (!wldev)
4617                 goto out;
4618
4619         wldev->dev = dev;
4620         wldev->wl = wl;
4621         b43_set_status(wldev, B43_STAT_UNINIT);
4622         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4623         tasklet_init(&wldev->isr_tasklet,
4624                      (void (*)(unsigned long))b43_interrupt_tasklet,
4625                      (unsigned long)wldev);
4626         INIT_LIST_HEAD(&wldev->list);
4627
4628         err = b43_wireless_core_attach(wldev);
4629         if (err)
4630                 goto err_kfree_wldev;
4631
4632         list_add(&wldev->list, &wl->devlist);
4633         wl->nr_devs++;
4634         ssb_set_drvdata(dev, wldev);
4635         b43_debugfs_add_device(wldev);
4636
4637       out:
4638         return err;
4639
4640       err_kfree_wldev:
4641         kfree(wldev);
4642         return err;
4643 }
4644
4645 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4646         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4647         (pdev->device == _device) &&                                    \
4648         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4649         (pdev->subsystem_device == _subdevice)                          )
4650
4651 static void b43_sprom_fixup(struct ssb_bus *bus)
4652 {
4653         struct pci_dev *pdev;
4654
4655         /* boardflags workarounds */
4656         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4657             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4658                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4659         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4660             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4661                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4662         if (bus->bustype == SSB_BUSTYPE_PCI) {
4663                 pdev = bus->host_pci;
4664                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4665                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4666                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4667                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4668                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4669                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4670                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4671                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4672         }
4673 }
4674
4675 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4676 {
4677         struct ieee80211_hw *hw = wl->hw;
4678
4679         ssb_set_devtypedata(dev, NULL);
4680         ieee80211_free_hw(hw);
4681 }
4682
4683 static int b43_wireless_init(struct ssb_device *dev)
4684 {
4685         struct ssb_sprom *sprom = &dev->bus->sprom;
4686         struct ieee80211_hw *hw;
4687         struct b43_wl *wl;
4688         int err = -ENOMEM;
4689
4690         b43_sprom_fixup(dev->bus);
4691
4692         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4693         if (!hw) {
4694                 b43err(NULL, "Could not allocate ieee80211 device\n");
4695                 goto out;
4696         }
4697         wl = hw_to_b43_wl(hw);
4698
4699         /* fill hw info */
4700         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4701                     IEEE80211_HW_SIGNAL_DBM |
4702                     IEEE80211_HW_NOISE_DBM;
4703
4704         hw->wiphy->interface_modes =
4705                 BIT(NL80211_IFTYPE_AP) |
4706                 BIT(NL80211_IFTYPE_MESH_POINT) |
4707                 BIT(NL80211_IFTYPE_STATION) |
4708                 BIT(NL80211_IFTYPE_WDS) |
4709                 BIT(NL80211_IFTYPE_ADHOC);
4710
4711         hw->queues = modparam_qos ? 4 : 1;
4712         wl->mac80211_initially_registered_queues = hw->queues;
4713         hw->max_rates = 2;
4714         SET_IEEE80211_DEV(hw, dev->dev);
4715         if (is_valid_ether_addr(sprom->et1mac))
4716                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4717         else
4718                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4719
4720         /* Initialize struct b43_wl */
4721         wl->hw = hw;
4722         spin_lock_init(&wl->irq_lock);
4723         rwlock_init(&wl->tx_lock);
4724         spin_lock_init(&wl->leds_lock);
4725         spin_lock_init(&wl->shm_lock);
4726         mutex_init(&wl->mutex);
4727         INIT_LIST_HEAD(&wl->devlist);
4728         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4729         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4730
4731         ssb_set_devtypedata(dev, wl);
4732         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4733                 dev->bus->chip_id, dev->id.revision);
4734         err = 0;
4735 out:
4736         return err;
4737 }
4738
4739 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4740 {
4741         struct b43_wl *wl;
4742         int err;
4743         int first = 0;
4744
4745         wl = ssb_get_devtypedata(dev);
4746         if (!wl) {
4747                 /* Probing the first core. Must setup common struct b43_wl */
4748                 first = 1;
4749                 err = b43_wireless_init(dev);
4750                 if (err)
4751                         goto out;
4752                 wl = ssb_get_devtypedata(dev);
4753                 B43_WARN_ON(!wl);
4754         }
4755         err = b43_one_core_attach(dev, wl);
4756         if (err)
4757                 goto err_wireless_exit;
4758
4759         if (first) {
4760                 err = ieee80211_register_hw(wl->hw);
4761                 if (err)
4762                         goto err_one_core_detach;
4763         }
4764
4765       out:
4766         return err;
4767
4768       err_one_core_detach:
4769         b43_one_core_detach(dev);
4770       err_wireless_exit:
4771         if (first)
4772                 b43_wireless_exit(dev, wl);
4773         return err;
4774 }
4775
4776 static void b43_remove(struct ssb_device *dev)
4777 {
4778         struct b43_wl *wl = ssb_get_devtypedata(dev);
4779         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4780
4781         /* We must cancel any work here before unregistering from ieee80211,
4782          * as the ieee80211 unreg will destroy the workqueue. */
4783         cancel_work_sync(&wldev->restart_work);
4784
4785         B43_WARN_ON(!wl);
4786         if (wl->current_dev == wldev) {
4787                 /* Restore the queues count before unregistering, because firmware detect
4788                  * might have modified it. Restoring is important, so the networking
4789                  * stack can properly free resources. */
4790                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4791                 ieee80211_unregister_hw(wl->hw);
4792         }
4793
4794         b43_one_core_detach(dev);
4795
4796         if (list_empty(&wl->devlist)) {
4797                 /* Last core on the chip unregistered.
4798                  * We can destroy common struct b43_wl.
4799                  */
4800                 b43_wireless_exit(dev, wl);
4801         }
4802 }
4803
4804 /* Perform a hardware reset. This can be called from any context. */
4805 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4806 {
4807         /* Must avoid requeueing, if we are in shutdown. */
4808         if (b43_status(dev) < B43_STAT_INITIALIZED)
4809                 return;
4810         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4811         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4812 }
4813
4814 #ifdef CONFIG_PM
4815
4816 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4817 {
4818         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4819         struct b43_wl *wl = wldev->wl;
4820
4821         b43dbg(wl, "Suspending...\n");
4822
4823         mutex_lock(&wl->mutex);
4824         wldev->suspend_in_progress = true;
4825         wldev->suspend_init_status = b43_status(wldev);
4826         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4827                 b43_wireless_core_stop(wldev);
4828         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4829                 b43_wireless_core_exit(wldev);
4830         mutex_unlock(&wl->mutex);
4831
4832         b43dbg(wl, "Device suspended.\n");
4833
4834         return 0;
4835 }
4836
4837 static int b43_resume(struct ssb_device *dev)
4838 {
4839         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4840         struct b43_wl *wl = wldev->wl;
4841         int err = 0;
4842
4843         b43dbg(wl, "Resuming...\n");
4844
4845         mutex_lock(&wl->mutex);
4846         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4847                 err = b43_wireless_core_init(wldev);
4848                 if (err) {
4849                         b43err(wl, "Resume failed at core init\n");
4850                         goto out;
4851                 }
4852         }
4853         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4854                 err = b43_wireless_core_start(wldev);
4855                 if (err) {
4856                         b43_leds_exit(wldev);
4857                         b43_rng_exit(wldev->wl);
4858                         b43_wireless_core_exit(wldev);
4859                         b43err(wl, "Resume failed at core start\n");
4860                         goto out;
4861                 }
4862         }
4863         b43dbg(wl, "Device resumed.\n");
4864  out:
4865         wldev->suspend_in_progress = false;
4866         mutex_unlock(&wl->mutex);
4867         return err;
4868 }
4869
4870 #else /* CONFIG_PM */
4871 # define b43_suspend    NULL
4872 # define b43_resume     NULL
4873 #endif /* CONFIG_PM */
4874
4875 static struct ssb_driver b43_ssb_driver = {
4876         .name           = KBUILD_MODNAME,
4877         .id_table       = b43_ssb_tbl,
4878         .probe          = b43_probe,
4879         .remove         = b43_remove,
4880         .suspend        = b43_suspend,
4881         .resume         = b43_resume,
4882 };
4883
4884 static void b43_print_driverinfo(void)
4885 {
4886         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4887                    *feat_leds = "";
4888
4889 #ifdef CONFIG_B43_PCI_AUTOSELECT
4890         feat_pci = "P";
4891 #endif
4892 #ifdef CONFIG_B43_PCMCIA
4893         feat_pcmcia = "M";
4894 #endif
4895 #ifdef CONFIG_B43_NPHY
4896         feat_nphy = "N";
4897 #endif
4898 #ifdef CONFIG_B43_LEDS
4899         feat_leds = "L";
4900 #endif
4901         printk(KERN_INFO "Broadcom 43xx driver loaded "
4902                "[ Features: %s%s%s%s, Firmware-ID: "
4903                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4904                feat_pci, feat_pcmcia, feat_nphy,
4905                feat_leds);
4906 }
4907
4908 static int __init b43_init(void)
4909 {
4910         int err;
4911
4912         b43_debugfs_init();
4913         err = b43_pcmcia_init();
4914         if (err)
4915                 goto err_dfs_exit;
4916         err = ssb_driver_register(&b43_ssb_driver);
4917         if (err)
4918                 goto err_pcmcia_exit;
4919         b43_print_driverinfo();
4920
4921         return err;
4922
4923 err_pcmcia_exit:
4924         b43_pcmcia_exit();
4925 err_dfs_exit:
4926         b43_debugfs_exit();
4927         return err;
4928 }
4929
4930 static void __exit b43_exit(void)
4931 {
4932         ssb_driver_unregister(&b43_ssb_driver);
4933         b43_pcmcia_exit();
4934         b43_debugfs_exit();
4935 }
4936
4937 module_init(b43_init)
4938 module_exit(b43_exit)